// SMTP relay · microsoft 365 & office 365
Your applications write on your behalf.
fluctuat routes your applications' mail through your Microsoft 365, as the real sender, with a copy in their Sent Items. Without recoding your apps, without PowerShell.
Microsoft is turning off basic SMTP authentication in 2026: your copiers and your ERP stop sending. the no-recode alternative.
# free, no card · first send in ~15 min
$ fluctuat send --from factures@acme.ch --to client@acme.ch ✓ delivered to Microsoft 365 ········ 202 ✓ copy · factures@acme.ch › Sent Items the client replies → the thread lands in their mailbox
Microsoft verified publisher (badge on the consent screen) · Mail.Send permission only, no reading of your mailboxes · every message body encrypted with a key unique to your organization
The case of an address shared by several people: the copy in Sent Items, even for a shared mailbox.
Why not just an SMTP relay
Direct Send and HVE (High Volume Email) are native Microsoft 365 mechanisms; neither leaves a copy with the sender. That is the gap fluctuat fills. Unlike a third-party service such as SendGrid or Mailgun, the message leaves from your own domain, on behalf of the employee, rather than from a third-party sending domain you must delegate via SPF/DKIM. The end of SMTP basic authentication on Microsoft's side (2026) makes this pressing: what changes and the no-recode alternative.
| fluctuat | SMTP Auth | Direct Send | HVE | |
|---|---|---|---|---|
| Copy in the real sender's Sent Items | ✓ | ✕ | ✕ | ✕ |
| Without reprogramming your applications | ✓ | ✓ | ✓ | ✕ |
| Queue, retries, send log | ✓ | ✕ | ✕ | ✕ |
| Works after SMTP Basic Auth is turned off | ✓ | ✕ | ✓ | ✓ |
Going further: a detailed comparison: Direct Send, SMTP relay and HVE in Microsoft 365.
# how it works
Create the account and grant Microsoft consent: a Global Admin approves one link. Mail.Send permission only, no reading, revocable at any time.
Add the mailboxes your applications send as, then point them to your dedicated endpoint, over SMTP or through the API.
Each message goes out as the real sender, with a copy in their Sent Items and a full log in the console.
Connect your applications
Two ways to send, the same pipeline behind. Point an existing piece of software over SMTP, or integrate the HTTP API with a single JSON POST.
smtp · software or copier
| server | your-subdomain.fluctuat.io |
| port | 587 (STARTTLS) or 465 |
| credential | created in the console |
| from: | a declared address |
| works with | any device that speaks SMTP AUTH + STARTTLS |
api · http
curl https://portal.fluctuat.io/api/v1/send \ -H "Authorization: Bearer flctt_…" \ -H "Content-Type: application/json" \ -d '{ "from": "invoices@your-domain.com", "to": ["client@example.com"], "subject": "Your invoice", "html": "<p>Hello…</p>" }'
Copier or scanner: scan-to-email on Office 365 without Basic Auth.
Security and compliance
A posture built for lines of business where a send must be provable, and where one customer's data must never reach another's.
The detail (encryption, isolation, erasure, log retention): Security page.
# pricing · priced per connected mailbox, messages included
To prove the copy in Sent Items on one address. 1 connected mailbox, 500 messages per month, no card.
create an accountYour first app that sends on behalf of your colleagues. 3 connected mailboxes, 90-day log, GDPR contract, email support.
15-day trialMultiple apps, multiple colleagues. 25 mailboxes connected, 12-month log with CSV export, priority support.
15-day trialFor sectors where a send must be provable: audit, regulation, litigation. Up to 150 connected mailboxes and audit support.
15-day trial1 connected mailbox = 1 Microsoft 365 address your applications send as. A device that always sends from the same address counts as one mailbox, whatever the number of users. Example: a copier (one address) plus an ERP (one address) is 2 mailboxes, the Team plan. Credential restriction by IP and FQDN and CSV log export are available on all plans. Free account, no card (Free plan); paid plans start with a 15-day trial, card required, then a monthly or annual subscription (2 months free), cancellable at any time. Fair use: 500,000 messages per month per organization. Invoice payment from Business up, through the contact form.
on premises · fluctuat Sovereign
You run it in your own infrastructure: server, VM, x86 or ARM NAS. Signed Docker image (cosign), your Graph secret never leaves your walls, no message passes through Dizzus.
from CHF 5,900 / year, per instance
request a quoteManaging several Microsoft 365 tenants? A partner program is in preparation. let's talk
# frequently asked questions
Do we need to change our applications?
No. Your applications speak SMTP (or HTTP) as they do today: you simply replace the outbound server with your dedicated endpoint, using a credential created in the console. No library to install, no PowerShell.
What is a connected mailbox?
The Microsoft 365 address your applications send as. It is the one that receives the copy in its Sent Items. A device that always sends from the same address counts as one mailbox, whatever the number of users.
A copier that scans for everyone, how many mailboxes?
One, as long as it sends from the same address (for example scan@your-domain.com), whatever the number of users. Billing counts sending addresses, not people. A copier plus an ERP, on two addresses, is two mailboxes, the Team plan.
How do we limit the addresses fluctuat can send as?
The sender allowlist is optional. If you declare one, fluctuat only sends as the listed addresses, whatever an application attempts. If you declare none, any address of your own Microsoft tenant may send: Microsoft stays the boundary. To lock the perimeter on the Microsoft side, you can also apply an Application Access Policy. Details on the Security page.
Does Dizzus read our emails?
No. The permission granted is Mail.Send only, with no reading of your mailboxes. Message content travels encrypted and is purged after delivery; the log keeps only the headers and the status.
Is Dizzus a Microsoft verified publisher?
Yes. Dizzus is a verified publisher: the badge appears on the Microsoft consent screen, before any authorization. The permission requested is Mail.Send only, with no reading of your mailboxes.
Is delivery guaranteed?
fluctuat confirms handoff to Microsoft 365, never "delivery" to the recipient, which no tool can promise. An accepted send is placed in a durable queue, retried automatically, and never silently dropped.
Can we leave easily?
Yes. Consent can be revoked at any time from your Microsoft tenant, the account is deleted from the console, and your account data exports in one click. No commitment period.
What happens to the content when the account is deleted?
On deletion, your organization's encryption key is destroyed immediately: the encrypted bodies become unreadable, including residual copies in backups, made unreadable and purged within 7 days. This erasure by key destruction meets the erasure obligation (FADP art. 32, GDPR art. 17).
Where does the data live?
Hosted version: OVHcloud infrastructure in London (United Kingdom), backups in France, log retained per plan (30 days to 12 months). The publishing company is Swiss (Dizzus GmbH, Zug); the hosted version's data is not in Switzerland yet. Sovereign version: everything runs in your infrastructure, no message passes through Dizzus.