Share via

office 365 "Cannot connect to SMTP server" "SSL negotiation failed"

Matthew Brady 195 Reputation points
2025-02-02T22:59:21.92+00:00

Hi team, I work for Ricoh and we have had several clients call in today with an error message when trying to scan. The error message is "Cannot connect to SMTP server" "SSL negotiation failed". Upon checking their setups they are all using office365 accounts for SMTP authentication, all of them stopped working this morning.

Have their been any updates or changes we need to be aware of?

Thanks

Office
Office
A suite of Microsoft productivity software that supports common business tasks, including word processing, email, presentations, and data management and analysis.
1,906 questions
Office Management
Office Management
Office: A suite of Microsoft productivity software that supports common business tasks, including word processing, email, presentations, and data management and analysis.Management: The act or process of organizing, handling, directing or controlling something.
2,277 questions
Accepted answer
  1. Dux, Monika 125 Reputation points
    2025-02-04T09:39:11.7533333+00:00

    Dear all, I just got a reply from Ricoh technician: "It looks to me as if Microsoft has disabled the cipher suites WITHOUT elliptic curves for TLS1.2. ECDHE is only possible with newer controllers from 18S onwards".

    Our affected MFPs models are: MP C307 , MP 6055, IM C3000, MP C3004ex, and they all have an older controller 16S or 17S.

    We also use IM C300, and, so far, this one seems to be affected.

    10 people found this answer helpful.

13 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marvin Telch 30 Reputation points
    2025-02-05T05:38:38.68+00:00

    Good morning everyone,

    I did a few analyses yesterday.

    I sent several queries via dig for smtp.office365.com via the large known European DNS servers. The result was 116 servers.

    Only one of these 116 servers still supports TLS_RSA. All others only support Elliptic Curve.

    Then I sent further queries via dig to DNS servers outside Europe and received 14 servers. Of these 14, 7 still support TLS_RSA.

    Please add one of these servers as smtp server for testing.

    Since the TTL of the IP addresses after resolution is less than 10 seconds, this also explains why about 1/4 scans work because a different mail server is addressed with each scan (DNS Round Robin).

    Unfortunately, I have not found any information from Microsoft that Microsoft disables TLS_RSA on its mail servers. Moreover, Microsoft does not seem to have done this on all mail servers (or not yet).

    List of servers that support TLS_RSA:

    40.99.148.242

    52.97.129.242

    52.97.146.162

    52.97.146.194

    52.97.211.210

    52.97.211.226

    52.98.207.2

    52.97.173.18

    40.99.218.98

    5 people found this answer helpful.
  2. Ben Barnes 30 Reputation points
    2025-02-07T06:30:33.14+00:00

    Can somebody Try enabling support for the legacy SMTP endpoint in their tenant:

    https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/opt-in-exchange-online-endpoint-for-legacy-tls-using-smtp-auth

    Then setting the SMTP Server on their Affected Printer to:

    • smtp-legacy.office365.com

    My guess is that this should work - your emails should still be encrypted with TLS 1.2 if your printer supports it, based on what OpenSSL Says (TLS 1.2 is supported on the endpoints I have been hitting with RSA)

    We are awaiting a change request to try this - can anybody get it implemented and tested faster than us to check?

    User's imageUser's image

    2 people found this answer helpful.
  3. Rodney Ty 5 Reputation points
    2025-02-04T16:38:37.3633333+00:00

    Any fix for sharp copiers?

    1 person found this answer helpful.
    0 comments
  4. Marvin Telch 30 Reputation points
    2025-02-05T06:53:58.2666667+00:00

    And once again: It seems that the servers that only offered Elliptic Curve via TLS1.2 yesterday now support TLS_RSA again! It looks like Microsoft is reversing the changes.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.