Free v1.0.2

Nova EmailRelay

Nova email that still works after Basic Auth is gone.

Download Nova EmailRelay Help with migrating from MRS

Free to download. No registration, no email address.

PS C:\NovaEmailRelay> emailrelay test send --to anna@example.com
Send Test (SMTP)
----------------------------------------
[OK] SMTP
  [+] Smtp.Host: smtp.office365.com
  [+] Smtp.Port: 587
  [+] Smtp.Username: relay@yourcompany.com
[OK] OAuth2
      Flow: ClientCredentials
  [+] OAuth2.ClientSecret: ****

Step 1: Acquiring OAuth2 token...
[OK] Token acquired successfully.
  Audience:  https://outlook.office365.com
  Roles:     IMAP.AccessAsApp, SMTP.SendAsApp
  Expires:   2026-09-21 10:42:17 UTC

Step 2: Connecting to SMTP...
[OK] Test email sent successfully.
  SearchKey: 9F2C41D07A3B5E6812C4A0F7D39B6E15

Drop-in replacement for MRS — no Nova or database changes

OAuth2 Modern Authentication, with client credentials or device code

Works with Office 365 and other standards-based mail servers

Built-in connection, permission and database tests

Test mode: recipient allow-list, blocked mail saved as .eml

One-command Windows service install, several instances per server

Nova EmailRelay replaces the legacy MRS service with a modern Windows service that relays Nova email over IMAP/SMTP or Microsoft Graph using OAuth2. Same database tables, same behaviour, and free to download.

The Message Relay Service that ships with Nova logs in to the mailbox with a stored password. Office 365 no longer accepts that. Nova EmailRelay takes over the same job — sending Nova's outgoing mail and storing replies, bounces and receipts on the case — using OAuth2 Modern Authentication. It is installed and verified from a self-documenting command line.

MRS dates from around 2001. Office 365 has moved on.

MRS logs in through Extended MAPI, with a profile name and a stored password. That is Basic Authentication, and Microsoft is removing it from Exchange Online.

MRS cannot be taught OAuth2. The day your mailbox moves to Modern Authentication, reminders and notices stop leaving Nova, and debtor replies, delivery reports and bounces stop arriving on the case.

Outgoing mail queues up silently. Letters stay at "pending" in Nova. Nobody is told until a customer asks where their notice is.
Incoming mail never reaches the case. Replies, non-delivery reports and read receipts sit in a mailbox nobody reads.
Workarounds cost you security. Exemptions, app passwords and on-premises relays all mean keeping a door open that your IT policy wants closed.
EmailRelay closes the gap. Same database tables, same behaviour, modern authentication. Nova does not notice the difference. Your security team does.

One small service between Nova and the mailbox

EmailRelay reads outgoing mail from the Nova tables and sends it. It fetches incoming mail and writes it back. Nova, and every module that reads those tables, carries on exactly as before.

On one side is the Nova database on SQL Server, with its schema untouched. On the other is the mail server: Office 365 or any standards-based server, reached over IMAP and SMTP, or over Microsoft Graph. In between, the service runs one loop on your schedule:

Send what Nova has queued.
Receive what has arrived in the mailbox.
Clean up sent and processed mail after the number of days you set.
Wait for the next interval.

Everything MRS did, plus what you wished it did

Drop-in compatible with Nova

Reads and writes the existing email tables with the same status codes, recipient types, importance levels and attachment handling. Delivery reports, non-delivery reports and read receipts are recognised and stored as the message classes Nova expects.

OAuth2, two ways

Client credentials for fully unattended operation, or a one-time device-code sign-in with automatic token renewal. Use the multi-tenant app registration Svalefelt provides, or bring your own.

IMAP and SMTP, with Microsoft Graph as an alternative

Standard IMAP and SMTP work with Office 365 and with other mail servers, including plain username and password where that is still what you have. For tenants that do not allow IMAP and SMTP, Microsoft Graph is available as an alternative transport — see the note on it under Questions.

A CLI that diagnoses itself

Test the database, sending and receiving separately. The tool decodes the token, lists the roles it carries, and tells you which permission is missing and where in the Azure Portal to add it.

Test mode with an allow-list

Run against live data without emailing a single debtor. Only approved addresses or domains are delivered; everything else is saved as an .eml file for inspection.

File-based relay and audit trail

Optionally route every message through .eml files on disk. Keep an archive of what was sent, insert a manual approval step, or import mail saved from Outlook straight into Nova.

Retries that know when to stop

Temporary faults are retried up to a limit you set. Permanent faults, such as a rejected recipient, fail at once and are flagged in Nova instead of clogging the queue.

Built to be monitored

Structured rolling log files, optional Grafana Loki output, and a webhook after every cycle reporting status, counts and duration.

Secrets stay secret

Client secrets are encrypted in the configuration file the moment you set them, and masked whenever configuration is displayed.

Schedules you already know

Independent send and receive intervals by minute, hour, day, work day, week, month or year. Automatic clean-up of sent and processed mail after a set number of days.

Readable mail, both directions

Plain-text letters can go out as properly formatted HTML with your choice of font. Incoming HTML is converted to clean text, with the original kept as an attachment if you want it.

One command to install

Registers itself as a Windows service. Run several named instances side by side when you serve more than one company or mailbox.

MRS and EmailRelay, side by side

	Legacy MRS	Nova EmailRelay
Mail access	Extended MAPI, needs a MAPI profile on the server	IMAP/SMTP or Microsoft Graph. No mail client or profile on the server
Authentication	Profile and password (Basic Auth)	OAuth2 Modern Authentication
Works with Office 365	Not once Basic Auth is off	Yes, and with other standards-based mail servers
Nova database	Native	Same tables, same values, no schema change
Configuration	INI file	Self-documenting command line, encrypted secrets
Platform	Windows NT service from around 2001	.NET 10 Windows service

Migrating from MRS: a service swap, not a project

Because the database contract is unchanged, the switch is a matter of stopping one service and starting another. Rolling back is just as simple.

Unpack and connect. Extract EmailRelay on the server, point it at the Nova database, and run test db.
Grant mailbox access. Approve the app in your Microsoft 365 tenant. Svalefelt supplies the checklist for your administrator.
Prove the connection. Run test send and test receive. Fix anything they point out.
Rehearse with test mode. Turn on the allow-list and run a real cycle. Only your own addresses receive anything.
Switch over. Stop MRS, run emailrelay install, start the service. Pending mail goes out on the next cycle.
Keep an eye on it. Point the webhook at your monitoring and let the log files look after themselves.

Questions

Do we need to change anything in Nova?

No. EmailRelay uses the same tables and the same values as MRS. Case handlers send and read email exactly as they do today.

Does it need Outlook or MAPI on the server?

No. It speaks IMAP, SMTP and Microsoft Graph directly. There is no mail client or profile to maintain.

We do not use Office 365. Can we still use it?

Yes. Any server that offers IMAP and SMTP will work, with OAuth2 or with a username and password.

Our tenant blocks IMAP and SMTP. Now what?

Switch the transport to Microsoft Graph. It needs only Graph mail permissions and works over HTTPS. One thing to know first: moving processed messages to a mailbox folder is not yet fully supported over Graph, so if you depend on that, ask before you plan around it.

What happens if the mail server is down?

Messages stay pending and are retried on the next cycle. After a configurable number of attempts a message is marked failed in Nova so someone can act on it.

Can we test without emailing real debtors?

Yes. In test mode only addresses and domains on your allow-list are delivered. Everything else is written to disk as .eml so you can see what would have gone out.

Can one server handle several companies?

Yes. Install one named service instance per database or mailbox, each in its own folder with its own configuration.

Where are credentials stored?

In the local configuration file, encrypted. They are masked in all command output. With client credentials there is no user password at all.

Move your Nova email to Modern Authentication before it stops

The download is free, and the built-in tests will tell you most of what you need to know. If you would rather not do the move alone, tell me which Nova version and mail platform you run. I will confirm the fit, walk your Microsoft 365 administrator through the permissions, and plan the switch-over with you.

Microsoft, Office 365 and Exchange Online are trademarks of the Microsoft group of companies.

Nova EmailRelay at the command line

7 console sessions. They follow the tool's real output; the addresses, server names and case numbers are example data.

PS C:\NovaEmailRelay> emailrelay test send --to anna@example.com
Send Test (SMTP)
----------------------------------------
[OK] SMTP
  [+] Smtp.Host: smtp.office365.com
  [+] Smtp.Port: 587
  [+] Smtp.Username: relay@yourcompany.com
[OK] OAuth2
      Flow: ClientCredentials
  [+] OAuth2.ClientSecret: ****

Step 1: Acquiring OAuth2 token...
[OK] Token acquired successfully.
  Audience:  https://outlook.office365.com
  Roles:     IMAP.AccessAsApp, SMTP.SendAsApp
  Expires:   2026-09-21 10:42:17 UTC

Step 2: Connecting to SMTP...
[OK] Test email sent successfully.
  SearchKey: 9F2C41D07A3B5E6812C4A0F7D39B6E15

One command proves the whole chain

Configuration, token, permissions and delivery, checked in that order.

test send reads the configuration, acquires an OAuth2 token, shows the roles the token carries, and then sends a real message. If any link in the chain is broken, this is where it shows — before the service is installed, not after.

# 1. Point it at Nova
PS> emailrelay config set Database.ConnectionString "Server=NOVASQL01;Database=Nova;Trusted_Connection=true"

# 2. Tell it how to sign in
PS> emailrelay config set OAuth2.Flow ClientCredentials
PS> emailrelay config set OAuth2.ClientSecret "********"
PS> emailrelay config set Smtp.Username relay@yourcompany.com
PS> emailrelay config set Imap.Username relay@yourcompany.com

# 3. Prove it works, then install
PS> emailrelay test db
PS> emailrelay test send --to you@yourcompany.com
PS> emailrelay run --once
PS> emailrelay install
Installing Windows Service "NovaEmailRelay"...
  Executable: C:\NovaEmailRelay\emailrelay.exe
  Display name: Nova Email Relay

Service "NovaEmailRelay" installed.
Start with: sc start "NovaEmailRelay"

From download to running service

A handful of `config set` commands, three tests, one install.

Configuration is a handful of config set commands. No INI files to hand-edit, no MAPI profile, no Outlook installation on the server.

PS> emailrelay test db --verbose
Database Connectivity Test
----------------------------------------
[OK] Database
  [+] Database.ConnectionString: Server=NOVASQL01;Database=Nova;...

Connection details:
  Server=NOVASQL01
  Database=Nova
  User Id=nova_relay
  Password=****

Connecting to database...
[OK] Connection successful
  Server: NOVASQL01
  Database: Nova
  Version: 16.00.4135

Required tables:
  [+] ncEmlOut
  [+] ncEmlOAd
  [+] ncEmlOAt
  [+] ncEmlIn
  [+] ncEmlIAd
  [+] ncEmlIAt
  [+] niDocEml
  [+] niDocDat

Check the database before you touch the mail

Connection, server version, and every table the relay depends on.

Confirms the connection, shows the server version, and verifies that every Nova table the relay depends on is present. Passwords in the connection string are never echoed.

PS> emailrelay test receive
Receive Test (IMAP)
----------------------------------------
Checking:       outlook.office365.com:993
As:             relay@yourcompany.com
Max messages:   10

Step 1: Acquiring OAuth2 token...
[OK] Token acquired successfully.
  Audience:  https://outlook.office365.com
  Roles:     SMTP.SendAsApp
  [!] Missing IMAP role - add 'IMAP.AccessAsApp' in Azure Portal > API permissions

Step 2: Connecting to IMAP...
[FAIL] IMAP authentication failed: AUTHENTICATE failed.

The token was acquired successfully, but the mail server rejected it.
For ClientCredentials flow, ensure:
  1. The app has 'IMAP.AccessAsApp' application permission in Azure Portal
     (Azure Portal > App registrations > API permissions)
  2. An admin has granted consent for the permission
  3. A service principal is registered in Exchange Online:
     New-ServicePrincipal -AppId <ClientId> -ServiceId <ObjectId>
  4. The service principal has mailbox access:
     Add-MailboxPermission -Identity <mailbox> -User <ServicePrincipal> -AccessRights FullAccess

When something is wrong, it says what

A missing permission, named, with the commands that fix it.

Office 365 permission problems are the hardest part of any OAuth2 rollout. EmailRelay reads the token it was given, spots the missing role, and hands your Exchange administrator the exact commands to run.

PS> emailrelay run
[10:15:00 INF] EmailRelay orchestrator starting (Send.Mode=Direct, Receive.Mode=Direct)
[10:15:01 INF] Sending 3 pending email(s)
[10:15:02 INF] Sent email 104512: Payment reminder - case 2026/1187
[10:15:02 INF] Sent email 104513: Notice of collection - case 2026/1203
[10:15:03 WRN] Email 104514 transient failure (attempt 1/5), will retry: 451 4.7.0 Temporary server error
[10:15:04 INF] Received 2 new email(s)
[10:15:04 INF] Stored incoming email 88231: RE: Payment reminder - case 2026/1187
[10:15:04 INF] Stored incoming email 88232: Undeliverable: Notice of collection - case 2026/0984
[10:15:05 INF] Cycle completed: Ok, sent=2, received=2, duration=4312ms

Watch a live cycle

What it sent, what it received, what it will retry and why.

Run in the foreground to see exactly what the service does: what it sent, what it received, what it will retry and why. The same lines go to the rolling log file, and the closing summary goes to your webhook.

PS> emailrelay authorize
[OK] OAuth2
      Flow: DeviceCode

To authorize this device, visit:
  https://microsoft.com/devicelogin

Enter code: H7KQ2XWPM

Waiting for authorization...
Authorized as: relay@yourcompany.com

Sign in once, run for months

The device-code flow, for when there is no client secret.

No client secret available? Use the device-code flow. Sign in to the mailbox once from any browser; EmailRelay keeps the token fresh from then on.

PS> emailrelay export --folder D:\Review
Export Pending Emails
----------------------------------------
Target folder: D:\Review

Exporting 2 email(s)...

  [+] 104515: Payment plan confirmation - case 2026/1240
      -> 104515_20260920_101500_412.eml
  [+] 104516: Final notice - case 2026/0871
      -> 104516_20260920_101500_655.eml

[OK] Exported 2/2 email(s) to D:\Review

Mail as files, when you need it

Export the pending queue to .eml, or import .eml into Nova.

Export the pending queue to .eml for review, or import .eml files into Nova without touching the mail server at all. Useful for audits, for approval workflows, and for getting a stray Outlook message onto the right case.