SMTP connectivity

When private hosting Turbo360, the correct SMTP configuration for email notifications depends on two parameters: the visibility of your SMTP server (public or private) and how your App Service is network-integrated. This article describes the supported configuration options and the requirements for each.

Business value

Correctly configuring SMTP connectivity ensures that Turbo360 alert and notification emails reach their recipients without interruption. Choosing the wrong option — or misconfiguring allow-lists — results in silent notification failures that are difficult to diagnose after deployment.

How it works

The two parameters that determine your configuration are:

• SMTP server visibility

  • Public — e.g. SendGrid, Office 365

  • Private — e.g. Exchange Server within your network

• App Service VNet integration

  • Not configured

  • Configured with default routing

  • Configured with all traffic routed via the VNet

The table below summarises the supported scenarios. Detail for each option follows.

Option 1

Parameters

• SMTP visibility: Public

• App Service VNet integration: Not configured

Required configuration

• Add the outbound IP addresses of the web app and processor function app to the SMTP allow list. Use the Az CLI commands below to retrieve these addresses.

Considerations

• Port 25 will not work in this scenario — Azure blocks outbound port 25 from App Service. Use port 587 instead.

• This scenario results in a large number of IP addresses to allow-list.

Use the following Az CLI commands to retrieve the outbound IP addresses:

az webapp show -g <rg> -n <app> --query outboundIpAddresses -o tsv

az webapp show -g <rg> -n <app> --query possibleOutboundIpAddresses -o tsv

az functionapp show -g <rg> -n <app> --query outboundIpAddresses -o tsv

az functionapp show -g <rg> -n <app> --query possibleOutboundIpAddresses -o tsv

Option 2

Parameters

• SMTP visibility: Public

• App Service VNet integration: Enabled

• VNet routing: Default

Required configuration

• Add the outbound IP addresses of the web app and processor function app to the SMTP allow list. Use the Az CLI commands in Option 1 to retrieve these addresses.

Considerations

• Port 587 is recommended. Port 25 should work in this scenario.

• This scenario results in a large number of IP addresses to allow-list.

Option 3

Parameters

• SMTP visibility: Public

• App Service VNet integration: Enabled

• VNet routing: All traffic to VNet

Required configuration

• Add the IP address range of the device controlling outbound traffic from your VNet to public resources to the SMTP allow list. This is typically a VNet Gateway or firewall — configure the IP range for the traffic that egresses through it.

Considerations

• Port 587 is recommended. Port 25 should work in this scenario.

Option 4

Parameters

• SMTP visibility: Private

• App Service VNet integration: Enabled

• VNet routing: All traffic to VNet

Required configuration

• Add the subnet address range that the App Service traffic flows into — for the web app and processor function app — to the SMTP allow list.

Considerations

• Port 587 is recommended. Port 25 should work in this scenario.

Other considerations

Using an App Service Environment V3

If you are using an App Service Environment V3, your scenario maps to Option 2 or Option 3 depending on how you have configured routing for your VNet integration.

Troubleshooting

1. Notification emails are not being delivered after deployment
   Cause: The SMTP allow list has not been updated with the correct outbound IP addresses for the web app or processor function app.
   Fix: Retrieve the current outbound IP addresses using the Az CLI commands in Option 1 and add them to your SMTP server's allow list. Note that Azure may rotate possible outbound IPs — use possibleOutboundIpAddresses to capture the full range.

2. Email delivery works intermittently
   Cause: Azure App Service outbound IPs can change when the App Service plan is scaled or redeployed, and the allow list may not include all possible outbound addresses.
   Fix: Use the possibleOutboundIpAddresses query instead of outboundIpAddresses to ensure the full range of potential IPs is allow-listed.

3. SMTP connection times out when VNet integration is enabled with default routing
   Cause: With default VNet routing, public traffic still exits through App Service's public outbound IPs. If the SMTP allow list only contains private or subnet IPs, the connection will be blocked.
   Fix: Confirm you are using Option 2 (VNet integration, default routing) and allow-list the public outbound IPs of the web app and processor function app.

4. SMTP connection fails for a private SMTP server with VNet integration enabled
   Cause: The App Service subnet address range has not been added to the private SMTP server's allow list, or VNet routing is not configured to route all traffic through the VNet.
   Fix: Verify that VNet routing is set to route all traffic through the VNet (Option 4), then add the App Service subnet address range to the SMTP allow list.

5. Port 25 connection is refused even when SMTP server is accessible
   Cause: Azure blocks outbound port 25 from App Service in Option 1 (no VNet integration). This is an Azure platform restriction that cannot be overridden.
   Fix: Switch to port 587 for all SMTP connections from Turbo360.

Use Network Troubleshooter in Azure portal

If your app is VNet-integrated, navigate to App Service > Networking > VNet Integration > Network Troubleshooter, then:

• Set Destination Type to FQDN or IP.

• Enter your SMTP server and port (e.g. smtp.yourserver.com:587).

• The tool traces the connection from your App Service subnet and identifies whether routing, DNS, or NSGs are blocking it.

See: Azure App Service VNet Integration troubleshooter

Related articles

• Troubleshoot outbound SMTP connectivity in Azure

• Connectivity test script