Wiki.js email and the Microsoft 365 Basic auth shutdown
Wiki.js is a self-hosted wiki engine, usually run for a team, a community or one household. It sends:
- a welcome email with a login link, when an administrator creates a user account
- an account-verification link, when self-registration is enabled and someone signs up
- a password-reset link, when a user asks for one
None of that is noisy, and none of it is noticed when it stops. Mail that is never sent leaves no error on any screen anybody looks at.
What changes at the end of December 2026
If these messages go out through Microsoft 365 with a username and a password, Exchange Online stops accepting that by default. Not throttles — refuses. An administrator can switch it back on, which buys time rather than solving it: Microsoft announces the final removal date in the second half of 2027, and tenants created after December 2026 do not get the option at all.
Which of the four you are looking at is decided by the exact string the server sends back.
Why this application fits a free relay
All three go to somebody the operator already invited or who is already using the wiki. A private instance run for a team or a community never sends enough of these to approach a daily cap sized for a mail server, not a wiki.
That is the honest test, and it is worth applying before the settings: mail leaves from a generated @msgwing.com address rather than your own domain, and the cap is 200 messages a day. For an invoice or a shop receipt that is disqualifying. For Wiki.js it usually is not.
Settings
Administration -> Mail, in the web interface. Wiki.js keeps the values in its own configuration store, not in a file. It has no documentation page naming the individual fields, so the names below are the property names Wiki.js itself uses - read from its GraphQL mail schema and mail-transport source, not off a rendered page.
| Setting | Value |
|---|---|
senderEmail | your @msgwing.com login |
host | mx.msgwing.com |
port | 587 |
secure | off |
verifySSL | on |
user | your @msgwing.com login |
pass | your @msgwing.com password |
Register at msgwing.com first — the login and password are generated and shown once.
The part worth reading twice
secure is passed straight through to Nodemailer’s own secure option (see server/core/mail.js) - it is not a generic “use encryption” toggle. secure: true means implicit TLS, which is port 465, not the port configured above. Leave it off on port 587 so Wiki.js negotiates STARTTLS instead; the label reads backwards from what actually happens on the wire. senderEmail also has to be the generated @msgwing.com address, not the wiki’s own domain - Wiki.js puts it straight into the From: header with no separate check.
Where these names come from
Every field above was read off Mail transport source (no docs page names these fields), Wiki.js’s own documentation, rather than recalled. If that page and this one disagree, that page is right and this one is out of date — say so.
Related
- Other self-hosted applications
- Connection values and every other application
- All SMTP AUTH error messages
- Tools that are a better fit than this one
Last reviewed 2026-08-29.
Updated 10 Sep 2026