Email Configuration

UTMStack v12 sends email through your own mail server (SMTP server). This page explains every field on the Email configuration page, how UTMStack connects to the mail server, ready-made settings for Microsoft 365, Google, Amazon SES and an internal relay, and what each error message means.

What UTMStack sends by email

Alert emails have the subject <organization name> [<first 8 characters of the alert ID>] <alert name>. Incident emails have the subject New incident: <incident name>.

Before you start

• You need the Administrator role. Viewing the page needs config.read and saving or testing needs config.write.

• Your own user needs a real email address: Send test sends to it.

• The UTMStack server must reach the mail server on its port. Many cloud providers block outgoing port 25 (see Cloud servers and port 25).

Open the page

Go to Configure > Settings > Email Configuration. The page title is Email configuration. Right after the first sign-in, UTMStack opens this page for you once you have set the administrator's email address.

SMTP server

Sender

Recipients

Type an address and click Add to add it to a list.

How UTMStack connects

UTMStack always opens a plain connection to the host and port first, then:

1. If the server offers STARTTLS (an upgrade to an encrypted connection), UTMStack switches to encryption, whatever you chose under Encryption. It checks the server's certificate: it must be valid, issued by a public certificate authority, and match the Host name.

2. If Encryption is TLS or SSL and a Username is set, UTMStack signs in with the username and password, using the PLAIN method. It signs in only over an encrypted connection.

3. If Encryption is None, or the Username is empty, UTMStack does not sign in. Use this for a relay that accepts mail from the UTMStack server's address.

In practice, TLS and SSL behave the same: both mean "sign in, over STARTTLS". Servers that expect encryption from the very first byte, usually on port 465, do not work with UTMStack. Use port 587 (or 25) with STARTTLS instead.

Save and test

1. Fill in the fields.

2. Click Send test. UTMStack sends "Mail configuration test" to your own email address, using the values on the screen. If the password field is blank, it uses the saved password.

3. If you see "Test email sent to" your address, check that the email arrived, including the spam folder.

4. Click Save changes. You see "Email configuration saved".

Send test does not save anything. Save the page after a successful test.

Settings for common mail services

Microsoft 365

UTMStack signs in with the PLAIN method only. Microsoft 365's authenticated submission service (smtp.office365.com) does not offer that method and answers "504 5.7.4 Unrecognized authentication type". Microsoft is also retiring password sign-in for that service. Send through a Microsoft 365 connector (SMTP relay) instead:

1. 1

   Create a connector in Exchange Online

   In the Exchange admin center, go to Mail flow > Connectors > Add a connector. Choose From: Your organization's email server and To: Office 365. Name it UTMStack, and choose By verifying that the IP address of the sending server matches one of the following IP addresses. Enter the UTMStack server's public IP address. Save.

2. 2

   Find your MX endpoint

   In the Microsoft 365 admin center, open Settings > Domains, select your domain and look at the MX record. Its value has the form contoso-com.mail.protection.outlook.com.

3. 3

   Fill in UTMStack

   Field	Value
   Host	Your MX endpoint, for example contoso-com.mail.protection.outlook.com
   Port	25
   Encryption	None (no sign-in; the connector recognizes the server's IP address, and STARTTLS is still used)
   Username, Password	Empty
   From address	An address in one of your Microsoft 365 domains, for example [email protected]

The server needs a fixed public IP address and must be able to send on port 25.

Gmail and Google Workspace

For Google Workspace organizations, the SMTP relay service is an alternative: in the Google Admin console, go to Apps > Google Workspace > Gmail > Routing > SMTP relay service, allow your domain's senders, tick Require SMTP Authentication and Require TLS encryption, and use host smtp-relay.gmail.com, port 587, TLS, with a Workspace user and its app password.

Amazon SES

While your SES account is in the sandbox, it can only send to verified addresses. Request production access in the SES console before you rely on it for alerts.

An internal relay (Postfix, Exchange Server, or another mail server)

If the relay offers STARTTLS, its certificate must come from a public certificate authority and match the Host name. If it uses a certificate from your own certificate authority, sending fails; either install a publicly trusted certificate on the relay, or turn off STARTTLS for connections from the UTMStack server on a network you trust.

Cloud servers and port 25

Many cloud providers block or limit outgoing connections on port 25, including Amazon EC2, Microsoft Azure and Google Cloud. If UTMStack runs in the cloud, use a service on port 587 (such as Amazon SES or Google's SMTP relay with sign-in), or, where your provider allows it, ask them to lift the limit (Google Cloud does not).

Set the Base URL

The Base URL is the address your users type in their browser to open UTMStack, for example https://siem.example.com. UTMStack builds the links in invitation and password-reset emails from it. If the Base URL is empty, those emails are not sent.

1. 1

   Find the address your users open

   Use the address you open UTMStack with in your browser, including https://, for example https://siem.example.com or https://192.0.2.10. Use a host name that matches your SSL certificate if you have installed one (see SSL Certificate).

2. 2

   Open Email Configuration

   Go to Configure > Settings > Email Configuration.

3. 3

   Replace the Base URL

   Under Sender, replace the value in Base URL with your address. Enter only https:// and the host name, without a path.

4. 4

   Save

   Click Save changes.

Troubleshooting

When Send test fails, the message has the form config[0] (<host>:<port>): <reason>. The reason comes from the connection or from your mail server.

If the test works but alert emails do not arrive:

• Check that Alert recipients > To is not empty.

• Check the spam folder and your mail server's logs.

• On the server, look for mail errors with docker service logs --since 1h utmstack_backend 2>&1 | grep -i mail.

If invitations or reset emails do not arrive, check the Base URL first: without it, UTMStack does not send them and only writes the failure to the backend log.

Email settings and tenants

On a multi-tenant licence, each tenant has its own email settings. A mail server field that a tenant has never saved uses the value of the default tenant, so tenants can send mail through the operator's mail server without setting up their own. See Multi-Tenancy Overview.

Each tenant administrator should open Email Configuration in their own tenant and set:

• Base URL to the tenant's own address, for example https://customer-a.example.com.

• Their own Alert recipients and Incident recipients.