You need to create new SMTP connector on Exchange server to allow Zammad host send mail with correct authentication. In my case it is SMTP TLS on TCP 25.
Do not edit existing connectors, this can cause much trouble, if you not Exchange guru.
P.S. I do not remember, but may be some permissions for receive connector also needed to be set. See below my settings.
Get-ReceiveConnector -Identity “EXCH1\Devices with AUTH SMTPTLS[25]” | fl *
AuthMechanism : Tls, BasicAuth, BasicAuthRequireTLS
Bindings : {0.0.0.0:25}
TlsCertificateName : “YOUR WILDCARD CERT HERE for DOMAIN.TLD”
Enabled : True
PermissionGroups : AnonymousUsers, ExchangeUsers, Custom
RemoteIPRanges : {1.1.2.1, “ZAMMAD IP HERE”}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
ExtendedProtectionPolicy : None
LiveCredentialEnabled : False
Name : Devices with AUTH SMTPTLS[25]
Get-ADPermission -Identity “Devices with AUTH SMTPTLS[25]” | where {($.Deny -eq $false) -and (
$.IsInherited -eq $false)} | Format-Table User,ExtendedRights
User ExtendedRights
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Accept-Any-Sender}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Accept-Authoritative-Domain-Sender}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Accept-Any-Recipient}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Submit}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-Accept-Headers-Routing}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-Bypass-Anti-Spam}
NT AUTHORITY\Authenticated Users {ms-Exch-Accept-Headers-Routing}
NT AUTHORITY\Authenticated Users {ms-Exch-Bypass-Anti-Spam}
NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Accept-Any-Recipient}
NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Submit}
NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Accept-Any-Sender}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Accept-Any-Sender}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Accept-Authoritative-Domain-Sender}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Accept-Any-Recipient}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-SMTP-Submit}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-Accept-Headers-Routing}
NT AUTHORITY\ANONYMOUS LOGON {ms-Exch-Bypass-Anti-Spam}
NT AUTHORITY\Authenticated Users {ms-Exch-Accept-Headers-Routing}
NT AUTHORITY\Authenticated Users {ms-Exch-Bypass-Anti-Spam}
NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Accept-Any-Recipient}
NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Submit}
NT AUTHORITY\Authenticated Users {ms-Exch-SMTP-Accept-Any-Sender}
===========================================================================