Enhanced Azure Security for sending Emails - November 2017 Update
Azure is committed to stopping SPAM and reducing the customer impact caused by negative IP reputation. Starting on November 15th, 2017, sending outbound email directly to external domains (such as outlook.com, gmail.com) from a Virtual machine (VM) will be made available only to certain subscription types. Outbound SMTP connections using TCP port 25 (primarily used for unauthenticated e-mail delivery) will be blocked for most new subscriptions (more details below).
This change in behavior is only applicable to new subscriptions and new deployments beginning on November 15, 2017.
The change will benefit both new and existing customers by preventing malicious users from using Azure IP addresses for abuse and adversely affecting the reputation of all Azure IPs.
Recommended Method of Sending E-mail
Microsoft recommends that Azure customers employ authenticated SMTP relay services (typically connected via TCP port 587 or 443, but often support other ports too) to send e-mail from Azure VMs or from Azure App Services. These services specialize in sender reputation to minimize the possibility 3rd party e-mail providers will reject the message. Such SMTP relay services include but are not limited to SendGrid. It is also possible you have a secure SMTP relay service running on premises that can be used.
Use of these e-mail delivery services is in no way restricted in Azure regardless of subscription type.
Enterprise Agreement Customers
For Enterprise Agreement Azure customers, there is no change in the technical ability to send e-mail without using an authenticated relay. Both new and existing Enterprise Agreement customers will be able to attempt outbound e-mail delivery from Azure VMs directly to external e-mail providers with no restrictions from the Azure platform. While Microsoft cannot guarantee e-mail providers will accept inbound e-mail from any given customer, delivery attempts will not be blocked by the Azure platform for VMs in Enterprise Agreement subscriptions. Customers will have to work directly with e-mail providers to resolve any message delivery or SPAM filtering issues with the specific provider.
Pay-As-You-Go Customers:
For customers who signed up before November 15th, 2017 using the Pay-As-You-Go or Microsoft Partner Network subscription offers, there will be no change in the technical ability to attempt outbound e-mail delivery. Customers will continue to be able to attempt outbound e-mail delivery from Azure VMs in these subscriptions directly to external e-mail providers with no restrictions from the Azure platform. Again, Microsoft cannot guarantee e-mail providers will accept inbound e-mail from any given customer and customers will have to work directly with e-mail providers to resolve any message delivery or SPAM filtering issues with the specific provider.
For Pay-As-You-Go or Microsoft Partner Network subscriptions created after November 15, 2017, there will be technical restrictions blocking e-mail sent directly from VMs in these subscriptions. Customers that need the ability to send e-mail from Azure VMs directly to external e-mail providers (not using an authenticated SMTP relay) can make a request to remove the restriction. Requests will be reviewed and approved at Microsoft’s discretion and will be only granted after additional anti-fraud checks are performed. To make a request, open a support case with the issue type Technical --> Virtual Network --> Connectivity --> Cannot send e-mail (SMTP/Port 25). Be sure to add details about why your deployment needs to send mail directly to mail providers instead of going through an authenticated relay.
Once a Pay-As-You-Go or Microsoft Partner Network subscription gets exempted, VMs in that subscription only will be exempted going forward. Microsoft reserves the right to revoke this exemption, should we determine a violation of our terms of service has occurred.
MSDN, Azure Pass, Azure in Open, Education, BizSpark, and Free Trial Customers:
Customers who create MSDN, Azure Pass, Azure in Open, Education, BizSpark, and Free Trial subscriptions after November 15, 2017 will have technical restrictions blocking e-mail sent from VMs in these subscriptions directly to e-mail providers to prevent abuse. No requests to remove the restriction can be made as they will not be granted.
Customers using these subscription types are encouraged to use SMTP relay services as outlined above.
Cloud Service Provider (CSP)
Customers that are consuming Azure resources via Cloud Service Provider (CSP) can create a support case with their Cloud Service Provider (CSP) of choice and request the CSP to create an unblock case on their behalf if a secure SMTP relay cannot be used.