Connect an SMTP relay to deliver policy-violation alerts by email.
Prerequisites
- Operator or Administrator access to Team Server
- A reachable relay, permitted sender address, and credentials if required
- Configured workers, preferably
BackgroundAsync - A pipeline or deployment reporting violations
Use implicit TLS (normally port 465) or required STARTTLS (normally 587), with TLS 1.2 or later. Plaintext, opportunistic TLS, and OAuth SMTP authentication are unsupported.
For a private relay, allow its network through settings.http.allowed_networks. Certificate validation uses public roots plus settings.http.ca_certificates; the certificate must match the configured host. See outbound policy.
Create an Integration
Open Integrations > Notify > Email, then Get Started or Create.
Configure the SMTP Connection
| Field | Value |
|---|---|
| Name | Unique name for the audience |
| Host, Port | Relay hostname or IP and port 1–65535 |
| Security | Implicit TLS or Required STARTTLS |
| Authenticate with username and password | Enable when required; supply both values |
Configure Delivery
Enter the required sender address and optional display name, prefilled as Endura Security. Enter one recipient per line, up to 128; duplicates are removed case-insensitively. An empty list mutes automatic delivery.
One message is sent to all recipients using Bcc. Addresses appear in the SMTP envelope, not message headers.
Configure Scope and Outcomes
Notifications, All Pipelines, and All Deployments start enabled. Narrow the scope and enable Include observed violations when testing observe mode. See shared delivery rules.
Validate and Create
Select Validate and create. Team Server validates DNS, TLS, authentication, and SMTP NOOP without sending mail. Success saves the integration as Active.
Test and Verify
Send a Test Email
Select Send test email under SMTP connection. It uses current recipient form values, including unsaved changes, with the saved sender and connection. Save connection edits with Validate and update connection first; testing is disabled while those edits are unsaved.
A successful test restores Active status and confirms relay submission to those recipients. It does not check scope, outcome settings, notification enablement, or workers.
Test End-to-End Delivery
- Enable notifications, configure recipients and scope, and confirm Active status.
- Run an in-scope build with a controlled violation; enable observed outcomes if using
observemode. - Confirm the violation and grouped email, then follow its link to the correct run. Later batches can produce more alerts.
Edit or Delete an Integration
Save notification settings updates the name, sender, recipients, options, and scope without revalidating the connection. Validate and update connection validates replacement SMTP settings and restores Active status. Re-enter the write-only password whenever updating an authenticated connection.
Deleting the integration removes its stored configuration and credentials, leaving the relay account unchanged.
Troubleshooting
Messages Are Not Arriving
Check Active status, notification enablement, recipients, scope, and observed outcomes. Send a test; check sender/recipient relay policy and spam quarantine. If the test works, check workers and Team Server application logs.
Connection Errors
| Message or condition | Action |
|---|---|
| Invalid sender or test address | Correct the address. |
| Invalid SMTP settings | Check host, port, encryption, and authentication. |
| Relay resolves to a blocked address | Allow only its network, then restart Team Server. |
| Relay could not be resolved | Correct the host and check Team Server DNS. |
| TLS negotiation failed | Check TLS mode, port, certificate name and chain, and TLS 1.2 support; configure an internal CA if needed. |
| Authentication rejected | Re-enter credentials and confirm SMTP authentication is permitted. |
| Request rejected | Use the reported SMTP code to check sender, recipient, and relay policy. |
| Timed out or unreachable | Check relay availability, routing, and firewall access. |
Integration Is Inactive
Only explicit SMTP authentication rejection marks an integration Inactive. DNS, network, TLS, timeout, and relay failures are logged without changing status. status_reconcile periodically validates the connection.
Correct credentials and validate the connection, or send a successful test, to restore delivery.
Internal Relay or CA
Mount the internal CA bundle and allow the smallest required network in the outbound policy. Prefer a hostname matching the relay certificate.