SMTPKeepFix "421 4.7.66 TLS 1.0 and 1.1 are not supported"
The full message reads "421 4.7.66 TLS 1.0 and 1.1 are not supported. Please upgrade/update your client to support TLS 1.2." The device connected to smtp.office365.com with an encryption version Exchange Online no longer accepts there; it requires TLS 1.2 or 1.3.
Option 1: firmware
Check whether the manufacturer offers firmware with TLS 1.2. Many older devices never got it.
Option 2: Microsoft's legacy TLS endpoint
Microsoft offers smtp-legacy.office365.com for clients that cannot do TLS 1.2. An administrator must opt in with Set-TransportConfig -AllowLegacyTLSClients $true, or in the Exchange admin center under Settings, Mail flow. It is not available in GCC, GCC High or DoD tenants, and it still uses SMTP AUTH with basic authentication, so it falls under the basic auth retirement.
Option 3: SMTPKeep port 2525
SMTPKeep's port 2525 accepts TLS 1.0 and 1.1 with STARTTLS. The device logs in to SMTPKeep with its own username and password, and SMTPKeep sends to Microsoft 365 over modern TLS with OAuth, so it keeps working after basic auth is retired. Use port 2525 with the settings below.
| SMTP server | smtp.smtpkeep.com |
| Port | 587 |
| Security | STARTTLS (may be labelled TLS, "Use SSL/TLS: STARTTLS" or "Secure connection") |
| Authentication | SMTP AUTH on, username and password from the SMTPKeep dashboard |
| From / device email address | The mailbox you chose for the device, for example scanner@yourdomain.com |
| Older devices | If the device only supports TLS 1.0 or 1.1, use port 2525 instead |