SMTP relay

The SMTP relay accepts mail from any program that speaks SMTP. It hands each message to POST /emails as one HTTP request. Every rule of the HTTP API applies: the API key, the rate limit, the domain check, suppression, idempotency and the request log. The relay itself stores nothing. Use it for a mail server, a CMS or an application that cannot call HTTP. A new application calls POST /emails directly.

Connection

Setting	Value
Host	smtp.f5send.com
Port	465. Implicit TLS: the connection starts encrypted.
TLS	TLS 1.2 or 1.3 with a public certificate. No STARTTLS. No port 587 or 25.
Authentication	AUTH PLAIN or AUTH LOGIN, after the TLS handshake.
Username	The id of the API key. Settings → SMTP in the console lists the ids.
Password	The API key token (f5_live_… or f5_test_…).

The relay accepts SEND, FULL and Test keys. A revoked, expired or unknown key answers 535 5.7.8. A username that does not match the key answers the same 535 5.7.8. The text is the same in every case, so a caller cannot probe for ids. Settings → SMTP shows copy-paste configuration for Postfix, WP Mail SMTP, Python, Node.js and .NET.

Caution: the relay refuses AUTH on a connection without TLS (530 5.7.0). Port 465 always starts with TLS, so only a client that connects in plain text sees this reply.

Test mode over SMTP

A Test key works over SMTP in the same way as over HTTP. The message goes through the full contract and never leaves the platform. The worker simulates the outcome from the local part of each recipient (bounce@, complaint@, ooto@, suppressionlist@). See Test mode.

What the relay reads from the message

Header or part	Becomes
From	from. The domain must have status Verified, and the key must allow it.
Envelope RCPT TO	The recipient list. See Envelope rules.
To, Cc	to and cc, for the addresses that also appear in the envelope.
Reply-To	reply_to
Subject	subject. Required.
Message-ID	The idempotency key. See Idempotency.
X-F5send-Kind	kind
X-F5send-Tag-<name>	One entry in tags with that name and the header value.
text/plain and text/html parts	text and html
Attachments	attachments: the same allow-list and 10 MiB cap as the API.

The relay drops every other header. That includes Date, Sender, List-Unsubscribe, a header Bcc and every custom X- header. The platform builds Message-ID, List-Unsubscribe and the DKIM signature itself. A display name, a subject or a header value with a control character (CR, LF, NUL) answers 553 5.6.0. A message with a bare LF line ending answers 550 5.6.0.

Envelope rules

• The relay ignores the envelope MAIL FROM; the header From names the sender.
• The envelope RCPT TO list decides who receives the message.
• A To or Cc address stays visible when it also appears in the envelope.
• Every other envelope recipient becomes a Bcc recipient.
• When no To address remains, the other recipients move to to.
• The relay refuses the 51st recipient during RCPT TO (452 4.5.3).

Mail clients and mail servers send Bcc in exactly this way: the address goes into the envelope only.

Idempotency

When the client sets a Message-ID, the relay sends Idempotency-Key: smtp:<key id>:<Message-ID> with the request. It strips the angle brackets and cuts the key to 200 characters. A repeat of the same Message-ID with the same key answers 250 2.0.0 queued as <original id> and sends nothing again. The smtp: prefix keeps SMTP keys apart from the keys of your HTTP calls, and one key apart from another. Without a Message-ID, every delivery attempt creates a new message. Set one in your client; the Python example on Settings → SMTP does; most libraries generate one.

Limits

Limit	Value	Reply
Message size	2 MB (2,000,000 bytes), attachments included	552 5.3.4
Header block	64 KB	552 5.3.4
Recipients	50 per message (To + Cc + Bcc)	452 4.5.3 during RCPT TO
Attachments (API rule, not the socket)	10 files, 10 MiB after decoding, content type as type/subtype	550 5.6.0
Connections	50 at the same time	421
Idle time	30 s between commands, 60 s to complete DATA	421 4.4.2
Commands before AUTH	5	421 and the relay closes the connection. AUTH itself does not count.
Rate limit	The per-key rate limit of the API (default 10 requests per second)	451 4.7.1
Failed logins	5 per IP or per key id in 10 minutes	421 4.7.0 and a 10-minute block

Reply codes

Reply	When
250 2.0.0 queued as <id>	The API accepted the message, or replayed it for a repeated Message-ID. <id> is the message id.
235	Authentication succeeded.
421 4.7.0 Too many authentication failures	5 failures in 10 minutes from one IP or for one key id; the block lasts 10 minutes. Also more than 20 failed AUTH attempts per second across the relay. Successful logins never count.
421 4.4.1 Temporary authentication failure	The relay could not reach the API during AUTH. Try again later.
421 4.4.2 Timeout - closing connection	DATA took more than 60 s.
451 4.4.1 Temporary system problem, try again later	The API answered 5xx or did not answer. The session stays open.
451 4.7.1 rate limited, retry later	429 rate_limited.
451 4.7.1 sending paused	403 sending_paused. An admin resumes sending in Settings → Organization (or the domain page for a domain pause).
452 4.5.3 Too many recipients	More than 50 recipients.
500	VRFY, EXPN and ETRN are not available (command not recognized).
530 5.7.0 Must issue a STARTTLS command first	AUTH on a connection without TLS.
535 5.7.8 Authentication credentials invalid	Wrong password, wrong username, or a revoked, expired or unknown key. Also a 401 from the API during a send.
550 5.1.3 No recipient	No recipient remained after the envelope rules.
550 5.6.0 <text>	Subject required, bare LF not allowed, or an API validation code such as validation_error, stream_mismatch or template_not_found. See Errors.
552 5.3.4 <text>	Message too large (over 2 MB), Header section too large (over 64 KB), or an API size code.
553 5.6.0 <text>	A problem with From: From address required, a control character, invalid_from or domain_not_verified.
553 5.7.1 <code>	forbidden_domain, unknown_domain, or another 403 from the API.

A 4xx reply is temporary: a mail server retries it on its own schedule. A 5xx reply is final: correct the message or the configuration, then send again.

Security

• The relay verifies each login against the API. There is no second SMTP password to protect.
• Five failed logins in 10 minutes from one IP, or for one key id, block it for 10 minutes.
• The relay logs the remote IP, key id, reply code and byte count; never the password, body or headers.
• Each accepted message appears in Logs as a POST /emails row with user-agent f5send-relay/<version> (smtp; ip=<your IP>).
• Your server connects to fixed public IP addresses; ask support for them when your outbound firewall needs an allow-list.

When the relay is down

The public status page shows an SMTP relay tile next to the worker. While the tile shows stale or none, your mail server keeps each message in its own queue and retries; nothing is lost. We follow a written procedure to restore it. Applications that can call HTTP keep sending through POST /emails, which does not depend on the relay.