SEND Exam Guide: Mail Submission, Routing, APIs, and Troubleshooting
The supplied official research does not include a formal SEND exam blueprint, candidate profile, prerequisites, scoring model, question count, or delivery specification. It does, however, identify a practical technical scope: sending messages through Microsoft Graph, selecting Exchange mail-flow methods, configuring connectors and certificates, interpreting nondelivery reports, and separating RPC or socket failures from mail-service failures. Use this guide to decide whether your preparation should focus on application development, Microsoft 365 administration, Exchange transport, or Windows network troubleshooting—and to verify the current exam details with the issuing organization before scheduling.
What the available evidence says SEND covers
The evidence supports a send-and-delivery troubleshooting domain rather than a general email memorization test. Prepare to follow a message from application or device submission through mailbox processing, transport routing, authentication, delivery, and diagnostic reporting. Treat this as an evidence-based scope guide, not as a replacement for an official SEND skills outline, because no such outline was supplied.
The central concepts fall into four connected areas. First, Microsoft Graph represents email as a message resource and supports either a single send action or a draft-then-send workflow. Second, Microsoft 365 provides several methods for devices and applications to submit mail. Third, Exchange Server uses Send connectors for outbound SMTP connections. Fourth, NDRs and network tools help isolate the reason delivery failed.
A candidate should therefore be able to explain not just how to submit a message, but what happens after submission and which administrator or system owns the next failure. That distinction is important: a successful API response does not by itself prove final delivery, while an RPC error may prevent an application from reaching its server before Exchange is involved.
Official facts versus preparation guidance
Officially supported facts in this guide are limited to the supplied Microsoft Learn material and verified facts. Recommendations such as building a lab, keeping an error notebook, or studying in dependency order are practical preparation choices, not stated exam requirements. The snapshot contains no SEND domain weights, so this guide does not assign percentages or pretend that one topic has a larger official share.
Who should use this preparation path
This path best fits candidates who work with Microsoft Graph mail automation, Microsoft 365 mail submission, Exchange Server transport, business applications that send notifications, or Windows environments where RPC and socket connectivity affect service operation. It is also suitable for administrators who must interpret an NDR and decide whether to correct an address, authentication setting, connector, certificate, firewall, or recipient-side condition.
The supplied device-and-application guidance specifically discusses network-connected scanners and line-of-business applications that create messages but cannot send them without help. That makes application owners and Microsoft 365 administrators natural audiences for the material. Exchange administrators need the connector and routing sections, while Windows support specialists need the RPC and Winsock sections.
Choose your starting point by your job rather than by the order of the documentation. An application developer should begin with message resources, IDs, permissions, and asynchronous processing. A tenant administrator should begin with the four submission methods and their requirements. An Exchange Server administrator should begin with connector address spaces, source servers, DNS or smart-host routing, and TLS. A network specialist should begin with TCP port 135, dynamic RPC ports, and socket return codes.
A sensible self-assessment
Before studying, write down one real workflow you need to support: for example, a scanner sending to an internal mailbox, an application sending externally, or an Exchange Server routing Internet mail. Mark each hop as known, uncertain, or untested. This reveals whether your gap is API construction, service configuration, transport design, or fault isolation.
Which Microsoft Graph behaviors to master
Learn the difference between creating and sending a message in one action and creating a draft that is later sent. Also learn that a message ID is not a permanent business key: Microsoft Graph documentation says to reference the message by its current ID for further processing because the ID can change when the message is copied or moved. These details support reliable automation and troubleshooting.
The Graph material describes email as the message resource. A draft is normally saved in Drafts and a sent message in Sent Items. The API can also support replies, reply-all operations, and forwards either directly or through a draft workflow. The from and sender properties are not interchangeable: from can reflect Send As rights, while sender can reflect delegated send-on-behalf behavior.
Do not stop at request syntax. The send-mail process creates a message in the sender’s mailbox, copies content, recipients, and attachments from the request, and returns an HTTP 202 Accepted status code when that initial operation succeeds. Later processing includes transport pickup, conversion into MIME where necessary, policy evaluation, routing, recipient delivery, and report generation. Study that sequence as a chain of ownership.
A particularly useful diagnostic distinction is the boundary after the initial Graph operation. Once the first step completes, the application’s direct interaction with Microsoft Graph is over. A later transport failure can produce an NDR rather than an API error. Your notes should therefore label each symptom as submission-time, mailbox-time, transport-time, routing-time, or recipient-time.
Graph study exercise
Create a decision table with columns for operation, draft state, message ID, folder, expected response, and later failure signal. Fill it for direct send, draft-then-send, reply, and forward. Then add cases for a moved message and a rejected recipient. This exercise tests process reasoning without relying on leaked or memorized questions.
How to choose a Microsoft 365 submission method
Select the submission method from the sender’s capabilities and destination, not from habit. Client SMTP submission uses a cloud mailbox and authentication; SMTP relay uses an inbound connector and a static IP or certificate; Direct Send is unauthenticated and limited to Microsoft 365 or Office 365 recipients; High Volume Email is intended for large volumes to internal recipients. The official comparison should be your final configuration authority.
Client SMTP submission is the natural option when the device or application can support TLS and authenticate with a licensed cloud mailbox. The supplied requirements identify TCP port 587 or 25, TLS support, and Microsoft 365 or Office 365 credentials. The method can send to organizational and Internet recipients through Microsoft 365 or Office 365, subject to service limits. The research also states that SMTP AUTH is disabled for organizations created after January 2020 but can be enabled per mailbox.
SMTP relay is more appropriate when the sending device or application can use a static public IP address or certificate and should act through Microsoft 365 or Office 365 as an email server. It does not require a licensed cloud mailbox, but it does require an inbound connector and an address associated with an accepted domain. Relay can send to organizational and Internet recipients, but it is not the same as Direct Send.
Direct Send avoids authentication by sending as an external email server directly to Microsoft 365 or Office 365. It is for recipients in accepted domains, not Internet relay. The supplied requirements identify TCP port 25 and an accepted-domain address. If the device or application needs external delivery, do not select Direct Send merely because it is simpler.
High Volume Email is a separate method for large-volume messages to internal recipients. The research says it requires an HVE account authenticated with Basic Authentication or Modern Authentication. Confirm the current HVE documentation before implementation because service scope and limits can change.
Method-selection questions
Ask five questions in order: Can the sender support TLS? Can it authenticate? Is a licensed mailbox available? Is the destination internal only or also on the Internet? Can the organization expose a static IP address or trusted certificate? The answers usually narrow the choice before any connector is created. Document the rejected alternatives so a later administrator understands the design.
Connector and routing decisions in Exchange Server
Exchange Send connectors control outbound SMTP connections from source Exchange servers to destination email servers. A connector is selected during routing resolution, so preparation should focus on how address spaces, network settings, scope, and source servers interact. Do not assume that installing Exchange automatically creates an Internet connector: the supplied documentation says no external Send connectors exist by default.
For external mail flow, configure a Send connector or subscribe an Edge Transport server to the Exchange organization. The connector’s network settings determine whether mail is routed through DNS or forwarded to a smart host. Its address spaces define the destination domains for which it is responsible. Scope controls visibility to other Exchange servers, and source servers identify where the connector is hosted and where mail is routed for delivery.
Internal Exchange communication is different. Implicit, invisible Send connectors are available for internal Exchange servers and require no management. This is a common study trap: a candidate may correctly describe an Internet connector but incorrectly claim that every internal path requires a manually created connector.
The supplied Exchange facts include a default maximum message size of 35 MB, approximately 25 MB after Base64 encoding. Keep the subject attached to the fact: this is the Exchange Server connector-related message-size detail, not a universal limit for every submission method or recipient system. Also note that the IsCoexistenceConnector and LinkedReceiveConnector parameters are no longer available in the cited Exchange Server material.
Connector troubleshooting worksheet
For each proposed connector, record source servers, address space, routing method, smart host or DNS choice, scope, TLS identity, and intended recipient class. Then trace a sample message from categorization to next hop. If the trace cannot identify one responsible connector, the design is not yet clear enough for production or for a scenario-based exam question.
Certificates, TLS, and authentication failures
Treat authentication and encryption as separate checks. A sender may reach the service but fail authentication; a server may authenticate but present a certificate that does not match the expected domain; or a remote server may not support TLS at all. Study the configuration inputs and the corresponding NDR language so you can identify which side must act.
For certificate-based SMTP relay, the supplied guidance requires a valid, unexpired X.509 certificate. The certificate’s Subject or SAN field must contain a verified accepted domain in Microsoft 365 or Office 365, and the connector can authenticate the device or application by TLS certificate or public IP address. A mismatch between the configured accepted domain and certificate identity is therefore a configuration problem, not an API coding problem.
Client SMTP submission requires TLS and uses a designated mailbox’s sign-in credentials. The supported requirements identify TCP port 587, or port 25, with TLS/StartTLS enabled and TLS 1.3 or TLS 1.2. If a device recommends port 465, the cited Microsoft guidance says it does not support the required TLS versions for client SMTP submission in Microsoft 365 or Office 365.
Use the error text to choose the next test. A 530 5.7.1 Client was not authenticated response indicates an authentication or submission configuration issue. Error 5.7.57 identifies a client that was not authenticated to send anonymous mail during MAIL FROM. Error 4.7.321 or 4.7.606 describes a destination TLS or certificate condition, while 5.7.367 points to SPF or DKIM authentication failures in forwarded or relayed email.
Avoiding certificate study mistakes
Do not memorize a certificate requirement without its purpose. Pair each fact with the validation it enables: accepted-domain identity, expiry status, TLS negotiation, or connector authentication. When reviewing a scenario, first identify whether the certificate belongs to the sending device, the inbound connector, or the destination server. That prevents treating every certificate error as the same fault.
How to read an NDR efficiently
Read an NDR from the enhanced status code and diagnostic text, then identify the responsible boundary. NDRs usually state why delivery failed, offer possible solutions, link to more help, and include administrator details. Start with recipient address and status code; only then examine host, authentication, policy, certificate, quota, or network clues.
Address failures should be separated from authorization failures. Error 5.1.10 means the SMTP address lookup did not find the recipient. Error 5.4.1 Recipient address rejected: Access denied means the recipient address does not exist, while 5.7.1 Delivery not authorized means the sender is not allowed to send to the recipient. A group, public folder, or mail user can also reject external senders with authentication-related codes.
For transport and recipient-server problems, distinguish temporary from permanent behavior. Error 4.4.316 Connection refused with socket error code 10061 indicates repeated connection failure to an external email server and usually points outside Microsoft 365 or Office 365. Error 4.4.7 Message expired means the message remained in the queue too long. A receiving server being available may allow a later delivery attempt, so do not treat every 4.x response as an address typo.
Policy and reputation failures require a different response. Error 5.7.606 identifies a banned sending IP, while 5.7.502 identifies a banned sending account. Error 5.7.705 or 5.7.708 indicates suspicious traffic from a tenant or IP. Error 5.7.509 identifies a sender domain that fails DMARC when the policy is reject. These are not fixed by changing a recipient spelling.
Use administrator diagnostics when the NDR is ambiguous. Microsoft’s guidance includes nondelivery report diagnostics, which requires a Microsoft 365 administrator account. Capture the complete code, enhanced status, remote server, sender, recipient, and original headers before changing configuration. A partial screenshot often removes the exact clue needed to select the correct remediation path.
NDR practice method
Build a table with four columns: code, immediate meaning, likely owner, and next verification. Include examples for a bad destination mailbox, unauthorized delivery, TLS failure, banned IP, routing loop, and connection refusal. Your goal is not to recite codes; it is to map evidence to an action while avoiding unsupported assumptions about which service generated the error.
RPC and socket troubleshooting boundaries
RPC troubleshooting belongs before application-level service diagnosis when the client cannot reach the server. The supplied Windows guidance explains that the client initially contacts TCP port 135, negotiates a dynamic port with the Endpoint Mapper, and then connects to the allocated port. A firewall must therefore allow port 135 and the relevant dynamic ports, not merely one known endpoint.
Learn the RPC vocabulary well enough to interpret a trace: the Endpoint Mapper resolves dynamic endpoints, a UUID identifies an RPC application, an opnum identifies the requested function, and stub data is the payload exchanged between client and server. This vocabulary helps distinguish name resolution, endpoint discovery, firewall filtering, and application execution.
The supplied troubleshooting workflow uses PortQry to test connectivity to port 135 and can reveal the dynamic port assigned by the Endpoint Mapper. It also uses Netsh network traces on client and server, followed by filtering for the relevant IP address and TCP port 135. These tools are useful because they test the path rather than merely repeating the failed application action.
For constrained RPC environments, the research describes configuring a port range through registry values and restarting the computer for the configuration to take effect. It also says that several system services rely on RPC ports and recommends opening a minimum of 100 ports. Treat this as a Windows network design consideration, not as a SEND exam-wide port requirement.
Winsock adds a second diagnostic layer. The send function transmits data on a connected socket and can return fewer bytes than requested. On a nonblocking stream-oriented socket, the number written can be between 1 and the requested length depending on buffer availability. Code must therefore handle partial sends rather than assuming one call transmits the entire buffer. WSAENOBUFS indicates that no buffer space is available, while WSAEWOULDBLOCK indicates that a nonblocking operation would block.
When not to blame Exchange
If the client cannot complete RPC endpoint negotiation, investigate DNS, port 135, dynamic-port reachability, and firewall rules before changing mail connectors. If a connected socket returns a partial send, inspect buffer handling and retry logic before changing SMTP policy. Keeping these layers separate prevents an application, network, and Exchange administrator from applying unrelated fixes to the same symptom.
A study sequence that builds usable skill
Study in dependency order: message construction first, submission-method selection second, Exchange routing third, security and certificates fourth, NDR interpretation fifth, and network-level troubleshooting last. This order follows the path of a message while still allowing you to revisit earlier layers when a later scenario exposes a missing prerequisite.
Begin with message lifecycle notes. Draw the path from request to Drafts, transport pickup, MIME conversion, policy evaluation, routing, delivery, and report return. Add current message ID, from, sender, recipients, attachments, and folder state. Test yourself by explaining what a 202 Accepted response proves and what it does not prove.
Next, compare the four Microsoft 365 methods in a matrix. Include destination, authentication, TLS, port, mailbox requirement, connector requirement, static IP requirement, and whether Internet relay is supported. Mark each cell as an official fact or a question to verify later. This keeps configuration rules from blending into assumptions.
Then work through Exchange connector design. Given an internal destination, an Internet destination, and a smart-host requirement, explain how address space and network settings select the route. Include the default absence of external Send connectors and the presence of implicit internal connectors. Follow with certificate identity and TLS cases.
Finish with fault isolation. Take one NDR at a time and classify it as address, permission, policy, quota, certificate, remote-server, or network failure. For RPC cases, decide whether port 135, dynamic ports, firewall rules, or application-level behavior is implicated. For Winsock cases, decide whether the code requires retry, buffer handling, reconnection, or a closed socket.
Study outputs to create
Produce four artifacts: a message-lifecycle diagram, a submission-method matrix, a connector worksheet, and an NDR decision table. These are more valuable than unannotated reading because each artifact forces you to connect a configuration choice with its observable result. Update them when the official documentation changes, especially for authentication and service-limit details.
A practical four-stage roadmap
Use the roadmap as a sequence of outcomes rather than a promise of a fixed number of study days. Complete each stage only when you can explain the result without copying the wording of a reference page. If the official SEND provider later publishes domain weights or delivery rules, insert those requirements before final revision and scheduling.
Stage one: establish the message path. Read the two Microsoft Graph sources, create sample lifecycle diagrams, and explain draft versus direct send, current message IDs, folder state, delegated sender behavior, and the meaning of a successful initial response. Your checkpoint is a short written explanation of where Graph ends and transport begins.
Stage two: design submission. Read the Microsoft 365 device-and-application guidance and select a method for three scenarios: an authenticated application, a scanner with a static public IP, and an internal high-volume sender. Record why each alternative is unsuitable. Verify current authentication and limit information directly from Microsoft before implementing a production design.
Stage three: route and secure. Read the Send connector documentation and pair each connector setting with its routing purpose. Then review certificate Subject or SAN identity, expiry, TLS, accepted domains, and connector authentication. Your checkpoint is a route diagram showing source server, address space, next hop, and the relevant security validation.
Stage four: diagnose. Use the NDR documentation to classify codes and the RPC and Winsock documentation to classify lower-layer failures. Practice choosing the first verification step rather than listing every possible fix. Your final checkpoint is a set of scenario notes that identify the symptom, boundary, owner, evidence, and next action.
Final revision pass
During final revision, close every note that lacks a source or label it as a personal recommendation. Replace vague statements such as “mail failed” with the exact layer: API submission, mailbox storage, transport pickup, policy, routing, TLS, recipient server, RPC endpoint, or socket buffer. This vocabulary improves both technical work and scenario-question accuracy.
Mistakes that waste preparation time
The most damaging mistake is treating a successful submission as proof of delivery. Graph can return 202 Accepted before later transport and routing work completes. Another is selecting Direct Send for Internet recipients, confusing SMTP relay with authenticated submission, or assuming that a manually created connector is required for internal Exchange traffic.
Avoid memorizing isolated SMTP codes without reading the surrounding diagnostic information. The same broad symptom—access denied—can represent a banned IP, banned sender, unauthorized recipient, failed authentication, or tenant policy. Always connect the code to the sender, recipient, remote host, and authentication context.
Do not mix Exchange Server connector facts with Microsoft 365 client-submission facts. A 35 MB Exchange Server maximum message-size detail is not a universal attachment promise. Likewise, TCP port 135 belongs to the RPC connection sequence, while SMTP submission and relay use the ports stated in their respective Microsoft 365 method requirements.
Do not change several variables at once. If authentication fails, preserve the recipient and message while checking credentials, SMTP AUTH availability, TLS, and port. If a certificate fails, preserve the route while checking expiry and Subject or SAN identity. If the remote server refuses a connection, verify reachability and remote service status before redesigning the tenant.
Finally, do not use dumps, leaked questions, or memorization claims as a substitute for understanding. They cannot establish that your configuration reasoning is correct, and they do not provide a reliable basis for current exam details. Use official documentation, controlled practice, and your own error classification instead.
A better correction loop
After each practice scenario, write one sentence for the observed evidence, one sentence for the most likely fault boundary, and one sentence for the next test. If the next test could not distinguish two hypotheses, choose a more targeted test. This simple loop turns wrong answers into diagnostic skill instead of repeated rereading.
What to verify before scheduling SEND
Do not schedule from this snapshot alone. It contains technical Microsoft Learn material but no verified SEND exam code details such as official objectives, prerequisites, question format, passing score, duration, languages, delivery method, pricing, or availability. Confirm those items on the issuing organization’s current page, then compare its domains with your study artifacts before paying for an appointment.
Check the exam identity first. The catalogue reference supplied here is SEND (2:exam:1631:ExamArticle), but the snapshot does not establish whether that label is a vendor exam name, an internal catalogue identifier, or a current public certification title. Resolve that ambiguity before relying on any third-party scheduling page.
Next, check the official skills outline and look for changes to Microsoft Graph, SMTP AUTH, High Volume Email, connector behavior, and service limits. The Microsoft Release Communications MCP documentation can help users retrieve current Microsoft 365 Roadmap and Azure Updates information through compatible clients, but it is not an exam blueprint. Use it for product-change awareness, not as proof of SEND scoring or coverage.
Finally, decide whether you are ready from performance evidence. You should be able to select a submission method, trace a Graph send beyond the API response, explain connector routing, interpret representative NDRs, and isolate RPC or Winsock issues. If you can only recognize terms, continue with scenario practice. If you can justify the first diagnostic action and its owner, move to official scheduling verification.
Your next actions
Download or bookmark the official SEND objectives once located. Build the four study artifacts, complete one scenario per fault layer, verify current exam logistics, and only then choose a date that fits your preparation. Keep a separate list of facts that may change so that a last review checks the official source rather than an old summary.
Official reading list
Use these Microsoft Learn pages for the technical subjects supported by the supplied research. They explain Graph message operations, Microsoft 365 submission methods, Exchange Send connectors, NDR interpretation, RPC connectivity, Winsock send behavior, and the Release Communications MCP Server. They do not, on their own, establish SEND’s exam logistics or blueprint.
Conclusion
The strongest preparation decision is to identify your likely failure boundary before choosing a study resource. Developers should prove message lifecycle and API reasoning; Microsoft 365 administrators should compare submission methods and authentication; Exchange specialists should trace connector routing; and Windows support specialists should test RPC and socket layers. Because the supplied evidence does not verify the SEND exam specification, confirm the current official objectives and scheduling details before booking. Then use the message diagram, method matrix, connector worksheet, and NDR decision table as working tools for targeted revision.
