SMTP ConfigurationCopy Anchor Link

This guide covers NorthRelay's SMTP settings in detail, including authentication, TLS configuration, and connection testing.

SMTP SettingsCopy Anchor Link

Use port 587 with STARTTLS unless your application only supports implicit TLS (port 465).

AuthenticationCopy Anchor Link

NorthRelay requires authentication for all SMTP connections. Your credentials are:

• Username: The email address you used to create your NorthRelay account (e.g., you@example.com)
• Password: An active API key from Dashboard → API Keys (e.g., nr_live_xxxxxxxxxxxx)

NorthRelay supports both LOGIN and PLAIN SASL mechanisms. Most SMTP clients will negotiate the mechanism automatically.

Creating an API KeyCopy Anchor Link

1. Log in to app.northrelay.ca
2. Go to Dashboard → API Keys
3. Click Create API Key
4. Copy the key immediately — it is shown only once
5. Use this key as your SMTP password

You can create multiple API keys for different applications. Revoke any key instantly from the same page.

TLS/SSLCopy Anchor Link

Port 587 — STARTTLS (Recommended)Copy Anchor Link

The connection starts unencrypted, then upgrades to TLS via the STARTTLS command. This is the industry standard for SMTP submission.

Client connects to smtp.north-pipe.ca:587 (plaintext)
Server: 220 smtp.north-pipe.ca ESMTP
Client: EHLO client.example.com
Server: 250-STARTTLS
Client: STARTTLS
  → TLS handshake occurs
Client: AUTH LOGIN (over encrypted channel)

Port 465 — Implicit TLSCopy Anchor Link

The connection is TLS-encrypted from the start. Use this if your application does not support STARTTLS, or if port 587 is blocked on your network.

Client connects to smtp.north-pipe.ca:465 (TLS immediately)
  → TLS handshake occurs
Server: 220 smtp.north-pipe.ca ESMTP
Client: EHLO client.example.com
Client: AUTH LOGIN (already encrypted)

TLS RequirementsCopy Anchor Link

• Minimum TLS version: 1.2
• TLS 1.0 and 1.1 are not supported
• Server Name Indication (SNI) is supported

Connection TestingCopy Anchor Link

Test with telnetCopy Anchor Link

Verify basic connectivity (does not test TLS):

telnet smtp.north-pipe.ca 587

Expected output:

Trying X.X.X.X...
Connected to smtp.north-pipe.ca.
220 smtp.north-pipe.ca ESMTP

Type QUIT to disconnect.

Test with opensslCopy Anchor Link

Verify STARTTLS on port 587:

openssl s_client -connect smtp.north-pipe.ca:587 -starttls smtp

Verify implicit TLS on port 465:

openssl s_client -connect smtp.north-pipe.ca:465

Both commands should display the TLS certificate chain and a 220 SMTP banner.

Test with swaksCopy Anchor Link

Send a full test email with authentication:

swaks --to test@example.com \
      --from you@yourdomain.com \
      --server smtp.north-pipe.ca:587 \
      --auth LOGIN \
      --auth-user your-email@example.com \
      --auth-password nr_live_xxxxxxxxxxxx \
      --tls \
      --header "Subject: SMTP Test" \
      --body "Testing NorthRelay SMTP"

Install swaks:

• Ubuntu/Debian: sudo apt install swaks
• macOS: brew install swaks
• RHEL/CentOS: sudo yum install swaks

Framework Configuration ExamplesCopy Anchor Link

Generic SMTP Settings BlockCopy Anchor Link

Use these values in any application that accepts SMTP configuration:

SMTP Host:       smtp.north-pipe.ca
SMTP Port:       587
Encryption:      TLS (STARTTLS)
Authentication:  Yes
Username:        your-email@example.com
Password:        nr_live_xxxxxxxxxxxx

Environment VariablesCopy Anchor Link

A common pattern for configuring SMTP in applications:

SMTP_HOST=smtp.north-pipe.ca
SMTP_PORT=587
SMTP_USER=your-email@example.com
SMTP_PASS=nr_live_xxxxxxxxxxxx
SMTP_SECURE=false
SMTP_TLS=true

The distinction between SMTP_SECURE and SMTP_TLS varies by library. SMTP_SECURE=false with SMTP_TLS=true typically means STARTTLS on port 587. SMTP_SECURE=true typically means implicit TLS on port 465.

Sending relayCopy Anchor Link

All users connect to the same smtp.north-pipe.ca host, on every plan. Your mail then leaves from NorthRelay's single sending relay:

There is nothing to configure — the path is identical for every account and does not change when you upgrade. See Sending Infrastructure.

TroubleshootingCopy Anchor Link

Connection timeoutCopy Anchor Link

• Verify your server can reach smtp.north-pipe.ca on port 587 or 465
• Some cloud providers (AWS EC2, GCP, Azure) block outbound SMTP by default — check your provider's documentation
• Try the alternate port (465 if 587 is blocked, or vice versa)

Authentication failure (535)Copy Anchor Link

• Username must be your NorthRelay account email, not a custom sending domain address
• Password must be an active API key starting with nr_live_
• Check for trailing whitespace when copying the API key

TLS errorsCopy Anchor Link

• Ensure your client supports TLS 1.2 or later
• On port 587, your client must send the STARTTLS command before authenticating
• On port 465, your client must initiate TLS immediately upon connection
• Update your system's CA certificate bundle if you see certificate verification errors

"Relay access denied" (554)Copy Anchor Link

• Confirm you are authenticated before sending
• Ensure the From address uses a domain you own or a NorthRelay subdomain

Related GuidesCopy Anchor Link

• Installation & Quick Start
• Send Your First Email
• DNS Setup Guide
• Node.js Integration
• Python Integration