Questions:

What is SMTP?

What is the client configuration for SMTP?

Answer:

While this document does not describe the SMTP service offered by Office 365 (O365), the O365 SMTP service should be evaluated for use cases that also consider smtp.wsu.edu as it may provide a more robust solution.


Description
smtp.wsu.edu is an outbound mail relay service used to send mail from WSU addresses to WSU and non-WSU destinations. With the introduction of O365, smtp.wsu.edu should be limited to programatic use.

When using email clients such as Outlook, smtp.wsu.edu should not be considered. This service is not appropriate for normal email.

Services

  1. submission (port 587), available globally. This service requires STARTTLS and requires an authenticated user to send mail. This is the recommended service for most use cases.
  2. smtps (port 465), available globally. This service requires SSL, and requires an authenticated user to send mail. This service should only be used when a client requires access to smtp.wsu.edu, but cannot use the 'submission' service.
    1. Note: Many clients will actually implement STARTTLS but indicate they are using SSL. Clients that claim to support SSL should use port 587, and fallback to port 465 only when port 587 fails to work.
  3. smtp (port 25), available from WSU-owned IPs associated with campuses and VPN networks. This service is anonymous, and encryption is not required or allowed. While this service is available, it is strongly recommended that all use of smtp.wsu.edu use the submission or smtps service instead. Authentication is not supported on this port.

Recommended Client Configuration

  • Use smtp.wsu.edu as the SMTP server. Do not use an IP address.
  • Use the submission service. Configure your client to use port 587 and STARTTLS
  • Use a service account with a unique password.
  • Configure SMTP-AUTH using LOGIN or PLAIN methods (if configurable).


Availability

smtp.wsu.edu is a HA service and is expected to be available 24/7/365. Systems are updated on a regular basis.


Authenticated Users

smtp.wsu.edu does not allow all WSU affiliated accounts to authenticate. To use this service, the account must be a NID or departmental service account.

The SMTP service does not support MFA, so a service account dedicated to sending mail is recommended and an MFA exception should be requested. As of Aug. 12, 2021, any service account with appropriate MFA exceptions can send mail using smtp.wsu.edu.

Submit requests for a service account and an MFA exception to the Crimson Service Desk (crimsonservicedesk@wsu.edu); please include the account name and the reason an exception is needed. 


Rate Limiting

By default, individual senders are rate limited.

For an on-campus sender, there are no connection restrictions. By default, individual senders ("From") are limited to 120 messages during a 30-minute rolling window. This limit can be increased as required on an individual basis.

Off-campus senders have the same message limits and additional connection limits: 3 to 6 simultaneous connections and 10 to 20 new connections per minute. Exact limits depend on service behavior at the time of the connection.


Routing

smtp.wsu.edu sends all mail via Proofpoint. If Proofpoint is unavailable or rejects email submissions, smtp.wsu.edu will hold mail and retry approximately 45 minutes later. smtp.wsu.edu will hold queued mail up to 5 days, and will attempt to notify the sender after 1 day.

smtp.wsu.edu passes DMARC (Domain-based Message Authentication, Reporting & Conformance) policy via SPF (Sender Policy Framework) and not DKIM (DomainKeys Identified Mail). This may impact delivery to some destinations.