main.cf fragment: relay to smart host

######################################################################
# identification of this mail system

myorigin = server42.corp.contoso.com
mydomain = corp.contoso.com

######################################################################
# relay control

# Controls are relaxed for members of $mynetworks (can relay mail, no rate
# limits, can use some exploitable SMTP features, etc.).
mynetworks =
    127.0.0.0/8
    [::1]/128
    10.0.0.0/8
    192.168.0.0/16

# Clients/remotes/scenarios to relay mail *for*.
smtpd_relay_restrictions =
    permit_mynetworks
    reject_unauth_destination

######################################################################
# smart host - outgoing mail

# Send all outbound mail to this mail server (smart host)
# Use "mail submission" protocol (TCP port 587)
relayhost = [smtp.office365.com]:submission

# When talking to our smart host, use this name to identify ourselves.
# Some mail hosts want a valid DNS name.
#smtp_helo_name = outgoing.contoso.com

# We have to authenticate ourselves to our smart host using SASL
smtp_sasl_auth_enable = yes
smtp_sasl_type = cyrus

# Don't allow plaintext passwords if connection lacks SSL/TLS/encryption
# If connection is encrypted, allow plain text passwords.
# "noanonymous" is equiv to Sendmail "y" mailer flag.
smtp_sasl_security_options     = noanonymous noplaintext
smtp_sasl_tls_security_options = noanonymous

# Credentials to use for outgoing SMTP connections (when Postfix is
# acting as an SMTP client).
smtp_sasl_password_maps = cdb:/etc/postfix/outgoing_passwd

# Force SSL/TLS outbound, since we should only be talking to our smart host.
# Further, require that the server's certificate verify against the CA root.
smtp_tls_security_level  = verify

# END