From 3491c65cbe0926c6815d0f8f9f637240ad98034a Mon Sep 17 00:00:00 2001 From: "Scott R. Shinn" Date: Sun, 28 Jun 2026 13:26:14 -0400 Subject: [PATCH] Warn about consumer and hosted SMTP relay restrictions Document that Gmail, Outlook.com, and Microsoft 365 typically block unauthenticated relay and point readers to authenticated SMTP setup. Closes #221 Assisted-By: Auto --- docs/manual/output/email-output.rst | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/manual/output/email-output.rst b/docs/manual/output/email-output.rst index c10e3756..8828bcbd 100644 --- a/docs/manual/output/email-output.rst +++ b/docs/manual/output/email-output.rst @@ -10,6 +10,19 @@ There are currently three types of email alerts: * Granular Notifications to any number of E-mail addresses * Daily E-mail Reports +.. warning:: + + **Consumer and hosted SMTP providers** (Gmail, Outlook.com, Yahoo, and similar) + generally do **not** allow unauthenticated relay from arbitrary servers. OSSEC sends + plain SMTP by default unless you configure authenticated mail (see + :ref:`manual-out-smtp-auth`). For Gmail you typically need an app password, OAuth, + or a relay service — not a bare ``smtp_server`` pointing at ``smtp.gmail.com``. + + **Microsoft 365 / Exchange Online** requires authenticated SMTP or a connector; + see `Microsoft's SMTP setup guide + `_. + Use :ref:`manual-out-smtp-auth` when your provider requires TLS and credentials. + .. warning:: Single E-Mail Notification must be setup before Granular Notification