Author: FaxCore Technical Engineering Team (Enterprise Solutions Architecture & Systems Engineering)

Published: October 19, 2026 Updated: October 19, 2026 Verified Architecture

FaxCore SMTP Listener Service (`FXC6.SMTPListenerAgent`)

The FaxCore SMTP Listener Service (FXC6.SMTPListenerAgent) is an enterprise-grade, high-performance inbound mail receiver built directly into FaxCore Evolution eV6. Designed as the modern, secure replacement for the deprecated Microsoft IIS 6.0 SMTP Virtual Server, the SMTP Listener runs as an independent Windows Service powered by Topshelf and .NET 4.8.

The SMTP Listener ingests inbound SMTP email traffic from Microsoft Exchange, Microsoft 365 (Exchange Online), Google Workspace, ERP applications, and multi-function printers (MFPs), applies multi-layered cryptographic and domain security controls, and hands off verified messages directly to FaxCore's SMTPGatewayAgent for Email-to-Fax dispatching.

Key Capabilities & Evolution

In legacy Windows Server and FaxCore deployments, Email-to-Fax workflows relied on the legacy IIS 6.0 SMTP Server feature to accept incoming port 25 traffic and drop .eml files into a file directory. Because Microsoft has deprecated and phased out IIS 6.0 SMTP in modern operating systems (Windows Server 2022 and Windows Server 2025), FaxCore engineered the SMTP Listener Agent to provide a self-contained, enterprise-hardened service.

Comparison: Legacy IIS SMTP vs. FaxCore SMTP Listener

Feature / Architecture	Legacy IIS 6.0 SMTP Service	FaxCore SMTP Listener (`FXC6.SMTPListener`)
Windows Server Support	Deprecated / Unsupported on 2022/2025	Native Windows Server 2019, 2022, and 2025 support
Service Framework	Legacy MMC IIS 6.0 Virtual Server	Modern .NET 4.8 / Topshelf Windows Service
Port Flexibility	Typically port 25 only	Multi-port concurrent listening (e.g., 25, 587, 465)
TLS/SSL Encryption	Legacy TLS 1.0/1.1; complex schannel tuning	Modern TLS 1.2 and TLS 1.3; STARTTLS and Implicit TLS
Certificate Store Integration	Manual IIS certificate bindings	Native integration with Windows Machine Store (`certlm.msc`) or `.pfx`
Domain Whitelisting	IP relay restrictions only	Granular sender (`MAIL FROM`) and recipient (`RCPT TO`) domain filtering
Cryptographic Validation	None	Native SPF (DNS TXT) and DKIM (RSA/ECDSA) verification
Quarantine & Anti-Spam	Unfiltered drop folder	Automated triage: valid to gateway, invalid spoofing to `spam`
Audit Archiving	None (overwritten or deleted)	Real-time immutable archival in `complete/` folder
Diagnostics & Logging	W3C text logs via IIS Manager	Structured log4net rolling logs + Windows Event Log telemetry

Architectural Message Flow

The SMTP Listener operates as the secure perimeter gateway in front of the FaxCore Email-to-Fax processing pipeline:

flowchart TD
    A["Mail Senders<br/>(Exchange, M365, Google, ERP, MFPs)"] -->|"Ports 25, 587, 465<br/>STARTTLS / Implicit TLS"| B["FaxCore SMTP Listener Service<br/>(FXC6.SMTPListenerAgent)"]
    
    subgraph Security_Gate ["Security & Access Filters"]
        B --> C{"Domain Filtering<br/>Enabled?"}
        C -->|"Not Whitelisted"| C1["550 Relaying Denied / Reject"]
        C -->|"Whitelisted / Disabled"| D{"SMTP AUTH<br/>Configured?"}
        D -->|"Invalid Auth"| D1["535 Authentication Failed"]
        D -->|"Passed / Unauthenticated"| E["SmtpMessageStore<br/>Save EML to inbox"]
    end
    
    subgraph Processing_Pipeline ["File Watcher & Validation Pipeline"]
        E --> F["FileSystemWatcher Event"]
        F --> G["Instant Copy to complete/<br/>(Audit Archive)"]
        G --> H{"Validation<br/>Enabled?"}
        H -->|"Disabled (0)"| I["Move to smtpgatewayDirectory<br/>(xgateway/smtp/inbox)"]
        H -->|"Enabled (1)"| J{"Run SPF & DKIM<br/>Verification"}
        J -->|"PASS"| I
        J -->|"FAIL"| K["Move to spam/ Directory<br/>(Quarantine)"]
    end
    
    subgraph Gateway_Execution ["FaxCore Fax Delivery Engine"]
        I --> L["FXC6.SMTPGatewayAgent"]
        L --> M["FaxCore Dispatcher & Render Engine"]
        M --> N["Fax Lines / FoIP Ports (SIP/T.38)"]
    end

    %% FaxCore Brand Palette Styling
    classDef darkBlue fill:#0B3348,stroke:#537DB5,stroke-width:2px,color:#FFFFFF;
    classDef logoBlue fill:#537DB5,stroke:#0B3348,stroke-width:2px,color:#FFFFFF;
    classDef orange fill:#FF9326,stroke:#333333,stroke-width:2px,color:#FFFFFF;
    classDef darkGrey fill:#333333,stroke:#FF9326,stroke-width:2px,color:#FFFFFF;

    class B,L,M,N darkBlue;
    class A,E,F,G,I logoBlue;
    class C,D,H,J orange;
    class C1,D1,K darkGrey;

    style Security_Gate fill:none,stroke:#537DB5,stroke-width:1.5px,stroke-dasharray: 4 4;
    style Processing_Pipeline fill:none,stroke:#537DB5,stroke-width:1.5px,stroke-dasharray: 4 4;
    style Gateway_Execution fill:none,stroke:#0B3348,stroke-width:1.5px,stroke-dasharray: 4 4;

Stage-by-Stage Processing Lifecycle

Connection & TLS Negotiation: Clients connect on configured standard ports (25, 587) or secure ports (465). The service presents the configured X.509 certificate and negotiates TLS 1.2 or TLS 1.3.
Mailbox & Domain Filtering: If enableIncomingDomainFiltering is active, the sender domain (MAIL FROM) is verified against allowIncomingDomains. If enableOutgoingDomainFiltering is active, the recipient domain (RCPT TO) is verified against allowOutgoingDomains.
Authentication: If user and password are set in <SMTPServer>, client authentication (SASL AUTH) is enforced.
EML Buffer Write & Archiving: The raw message stream is saved as a unique GUID file ({Guid}.eml) in xlistener\smtp\inbox. Upon file creation, an audit duplicate is instantly copied to xlistener\smtp\complete.
SPF & DKIM Triage:
- If isValidationEnabled is 0, the EML is immediately moved to smtpgatewayDirectory.
- If isValidationEnabled is 1, the message undergoes SPF DNS verification (v=spf1) and DKIM header signature checks. Messages passing validation are routed to smtpgatewayDirectory; failing messages are quarantined in spamDirectory.
Fax Rendering & Transmission: FXC6.SMTPGatewayAgent ingests the EML from its inbox, extracts the destination fax number and attachments, and dispatches the job to the FaxCore engine.

Directory Structure

The SMTP Listener Agent manages an isolated directory structure located at C:\FaxCore\svc.SMTPListenerAgent\:

Directory Path	Role & Operational Function
`xlistener\smtp\inbox`	Inbound Drop Directory: Initial landing folder where incoming SMTP streams are serialized into `{Guid}.eml` files.
`xlistener\smtp\complete`	Audit Archive Directory: Every incoming email is duplicated here before validation, providing an unalterable audit log of raw inbound transmissions.
`xlistener\smtp\spam`	Quarantine Directory: Emails that fail SPF or DKIM cryptographic verification are segregated here to prevent spoofing and spam faxing.
`xlistener\smtp\exception`	Exception Directory: Reserved directory for files encountering unexpected parsing or storage system exceptions.
`xlistener\smtp\unauthorized`	Unauthorized Directory: Reserved storage for rejected relay attempts.
`C:\FaxCore\svc.SMTPGateway\xgateway\smtp\inbox`	Gateway Hand-Off Inbox: Destination directory where valid, verified emails are moved so `FXC6.SMTPGatewayAgent` can process them for fax transmission.
`log\`	Service Logs: Contains active rolling logs (`SMTPListener.txt`) and historical date-stamped logs (`SMTPListener.txtYYYYMMDD`).

Note

All working subdirectories under xlistener\smtp\ are automatically created by the service on startup if they do not already exist.

Service Installation & Control

The SMTP Listener is managed through the Windows Service Control Manager under the service name FXC6.SMTPListener.

Service Display Name: FXC6.SMTPListenerAgent
Service Internal Name: FXC6.SMTPListener
Binary Path:          "C:\FaxCore\svc.SMTPListenerAgent\SMTPListenerAgent.exe"
Startup Type:         Automatic (Recommended in Production)

Managing via Windows Services (`services.msc`)

Press Win + R, type services.msc, and press Enter.
Locate FXC6.SMTPListenerAgent.
Right-click the service and select Start, Stop, or Restart.
To set automatic startup on boot, open Properties, change Startup type to Automatic, and click OK.

Managing via PowerShell

Open PowerShell as Administrator:

# Check service status
Get-Service -Name "FXC6.SMTPListener"

# Start the service
Start-Service -Name "FXC6.SMTPListener"

# Stop the service
Stop-Service -Name "FXC6.SMTPListener"

# Set service startup type to Automatic
Set-Service -Name "FXC6.SMTPListener" -StartupType Automatic

Topshelf Command-Line Commands

Because the agent is developed with Topshelf, administrators can execute commands directly against SMTPListenerAgent.exe:

:: Navigate to the service directory
cd C:\FaxCore\svc.SMTPListenerAgent

:: Install the service with automatic startup
SMTPListenerAgent.exe install --autostart

:: Uninstall the service
SMTPListenerAgent.exe uninstall

:: Start or stop the service
SMTPListenerAgent.exe start
SMTPListenerAgent.exe stop

:: Run interactively in the console (Ideal for real-time debugging)
SMTPListenerAgent.exe run

Tip

Running SMTPListenerAgent.exe run in an elevated Command Prompt or PowerShell terminal outputs all connection traces, TLS handshakes, domain filter evaluations, and SPF/DKIM verification results in real time without writing only to log files.

Configuration Reference (`SMTPListenerAgent.exe.config`)

The configuration file is located at:

C:\FaxCore\svc.SMTPListenerAgent\SMTPListenerAgent.exe.config

Complete Configuration Template

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections>
    <sectionGroup name="SMTPListener">
      <section name="SMTP" type="System.Configuration.NameValueSectionHandler" />
      <section name="SMTPServer" type="System.Configuration.NameValueSectionHandler" />
    </sectionGroup>
    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />
  </configSections>

  <!-- Rolling Log4Net Diagnostics Configuration -->
  <log4net>
    <appender name="RollingLogFileAppender" type="log4net.Appender.RollingFileAppender">
      <file value="log\SMTPListener.txt" />
      <appendToFile value="true" />
      <datePattern value="yyyyMMdd" />
      <rollingStyle value="Composite" />
      <maxSizeRollBackups value="10" />
      <maximumFileSize value="5MB" />
      <staticLogFileName value="true" />
      <layout type="log4net.Layout.PatternLayout">
        <conversionPattern value="%date [%thread] %-5level %logger - (%file:%line) - %m%n" />
      </layout>
    </appender>
    <root>
      <level value="ALL" />
      <appender-ref ref="RollingLogFileAppender" />
    </root>
  </log4net>

  <SMTPListener>
    <!-- Internal Storage, Working Directories, and Verification Policies -->
    <SMTP>
      <add key="baseDirectory" value="xlistener\smtp" />
      <add key="inboxDirectory" value="xlistener\smtp\inbox" />
      <add key="spamDirectory" value="xlistener\smtp\spam" />
      <add key="completeDirectory" value="xlistener\smtp\complete" />
      <add key="exceptionDirectory" value="xlistener\smtp\exception" />
      <add key="unauthorizedDirectory" value="xlistener\smtp\unauthorized" />
      <add key="smtpgatewayDirectory" value="C:\FaxCore\svc.SMTPGateway\xgateway\smtp\inbox" />
      <add key="bufferSize" value="65536" />
      <add key="isValidationEnabled" value="0" />
      <add key="enableSpfValidation" value="0" />
      <add key="enableDkimValidation" value="0" />
      <add key="publicKeyFilePath" value="" />
    </SMTP>

    <!-- SMTP Listening Ports, Cryptography, and Domain Whitelisting -->
    <SMTPServer>
      <add key="name" value="localhost" />
      <add key="port" value="25,587" />
      <add key="securePort" value="465" />
      <add key="user" value="" />
      <add key="password" value="" />
      <add key="enableIncomingDomainFiltering" value="0" />
      <add key="allowIncomingDomains" value="" />
      <add key="enableOutgoingDomainFiltering" value="0" />
      <add key="allowOutgoingDomains" value="" />
      <add key="commandTimeout" value="100" />
      <add key="certificateSubjectName" value="" />
      <add key="certificatePath" value="" />
      <add key="certificatePassword" value="" />
    </SMTPServer>
  </SMTPListener>

  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />
  </startup>
</configuration>

Section 1: `<SMTP>` (Storage & Email Validation Engine)

Key	Default	Type	Description
`baseDirectory`	`xlistener\smtp`	Path	Root relative directory for listener operational subfolders.
`inboxDirectory`	`xlistener\smtp\inbox`	Path	Drop folder where raw inbound SMTP messages are saved as `{Guid}.eml`.
`completeDirectory`	`xlistener\smtp\complete`	Path	Archive folder where a duplicate copy is preserved immediately upon receipt.
`spamDirectory`	`xlistener\smtp\spam`	Path	Quarantine folder where messages failing SPF or DKIM checks are routed.
`exceptionDirectory`	`xlistener\smtp\exception`	Path	Directory reserved for unhandled processing exceptions.
`unauthorizedDirectory`	`xlistener\smtp\unauthorized`	Path	Directory reserved for unauthorized relay events.
`smtpgatewayDirectory`	`C:\FaxCore\svc.SMTPGateway\xgateway\smtp\inbox`	Path	Destination folder monitored by `FXC6.SMTPGatewayAgent`. Valid emails are moved here.
`bufferSize`	`65536`	Integer	Memory buffer size (in bytes) utilized during file read/write operations.
`isValidationEnabled`	`0`	Boolean (`0`/`1`)	Master switch for security validation. `0` = Validation bypassed (all emails pass to gateway); `1` = SPF and/or DKIM validation enforced.
`enableSpfValidation`	`0`	Boolean (`0`/`1`)	Toggles Sender Policy Framework (SPF) validation against sender DNS records. Requires `isValidationEnabled="1"`.
`enableDkimValidation`	`0`	Boolean (`0`/`1`)	Toggles DomainKeys Identified Mail (DKIM) cryptographic signature verification. Requires `isValidationEnabled="1"`.
`publicKeyFilePath`	`""`	Path	Optional file path to a static public key file for offline DKIM verification when DNS lookups are restricted.

Section 2: `<SMTPServer>` (Network Endpoints & Access Control)

Key	Default	Type	Description
`name`	`localhost`	String	Server hostname or FQDN advertised in the SMTP `220` greeting banner and `EHLO`/`HELO` responses.
`port`	`25,587`	CSV Integers	Comma-delimited list of standard TCP listening ports. Operates in plain text or supports STARTTLS upgrade when a certificate is bound.
`securePort`	`465`	CSV Integers	Comma-delimited list of implicit SSL/TLS ports (SMTPS). Requires a certificate to be active.
`user`	`""`	String	Optional SMTP username for SASL authentication. If blank, unauthenticated connections are permitted.
`password`	`""`	String	SMTP password required when `user` is specified.
`enableIncomingDomainFiltering`	`0`	Boolean (`0`/`1`)	`1` = Enforces sender domain whitelisting. Only senders whose domain (`MAIL FROM`) is listed in `allowIncomingDomains` are accepted.
`allowIncomingDomains`	`""`	CSV Strings	Comma-separated list of permitted sender domains (e.g., `contoso.com,partner.org`).
`enableOutgoingDomainFiltering`	`0`	Boolean (`0`/`1`)	`1` = Enforces recipient domain whitelisting. Only recipients (`RCPT TO`) matching domains in `allowOutgoingDomains` are accepted.
`allowOutgoingDomains`	`""`	CSV Strings	Comma-separated list of permitted recipient fax domains (e.g., `fax.contoso.com,fax.mycompany.com`).
`commandTimeout`	`100`	Integer	Maximum timeout (in seconds) the listener will wait for subsequent SMTP client commands before terminating idle sessions.
`certificateSubjectName`	`""`	String	Common Name (CN) or Subject Name of an X.509 certificate installed in the Windows Local Computer Personal Store (`Certificates (Local Computer) \ Personal \ Certificates`). (Recommended)
`certificatePath`	`""`	Path	Absolute or relative path to a PKCS#12 (`.pfx`) certificate file. Used as an alternative to the Windows Certificate Store.
`certificatePassword`	`""`	String	Password for the `.pfx` certificate file. Can be supplied as plaintext or as a FaxCore encrypted token.

TLS/SSL Encryption & Certificate Setup

The SMTP Listener Agent provides native support for modern TLS 1.2 and TLS 1.3 cryptographic protocols across both explicit STARTTLS and implicit TLS endpoints:

STARTTLS Endpoints (port="25,587"): The server accepts initial plaintext connections, advertises the STARTTLS verb in EHLO, and upgrades the session to TLS on client request.
Implicit TLS Endpoints (securePort="465"): The session immediately begins with a TLS handshake before any SMTP protocol exchange occurs.

Method 1: Windows Certificate Store Binding (Recommended)

Using the Windows Local Computer Certificate Store (certlm.msc) provides centralized certificate lifecycle management, integration with Active Directory Certificate Services (AD CS), and seamless automated renewals (e.g., via Let's Encrypt / Certify The Web).

Step 1: Install the Certificate

Open certlm.msc (Certificates - Local Computer).
Navigate to Personal > Certificates.
Import your valid SSL/TLS certificate (ensure the certificate includes the private key).

Step 2: Grant Service Account Private Key Permissions

The service account running FXC6.SMTPListener must have Read permissions on the certificate's private key:

In certlm.msc, right-click the certificate > All Tasks > Manage Private Keys....
Click Add....
If running under the default account, add SYSTEM (or NETWORK SERVICE / your dedicated service account).
Check Read under Allow, then click OK.

Step 3: Configure `SMTPListenerAgent.exe.config`

Set the certificateSubjectName to match the certificate's Common Name (CN):

<SMTPServer>
  <add key="certificateSubjectName" value="fax.yourdomain.com" />
  <add key="certificatePath" value="" />
  <add key="certificatePassword" value="" />
  <add key="port" value="25,587" />
  <add key="securePort" value="465" />
</SMTPServer>

Note

When multiple certificates match the subject name, the SMTP Listener automatically inspects valid dates (NotBefore and NotAfter), filters out expired certificates, and binds the valid certificate with the latest expiration date.

Method 2: Standalone PFX Certificate File

If your organization deploys certificates as standalone files:

Copy the .pfx file to a secure directory (for example, C:\FaxCore\certs\fax_smtp.pfx).
Update the configuration:

<SMTPServer>
  <add key="certificateSubjectName" value="" />
  <add key="certificatePath" value="C:\FaxCore\certs\fax_smtp.pfx" />
  <add key="certificatePassword" value="YourPfxPassword" />
</SMTPServer>

Automated Password Encryption

To protect credentials on disk, the SMTP Listener includes an automatic password encryption feature:

When the service starts with a plaintext password in certificatePassword, CertificatePasswordLoader automatically intercepts the plaintext string.
It encrypts the password using FaxCore's internal cryptographic key.

It logs a notice with Event ID 168 containing the encrypted string:

[CERTPWD_PLAINTEXT|168] certificatePassword appears unencrypted. Replace value in App.config with: <EncryptedCiphertext>

Administrators can copy the <EncryptedCiphertext> value and replace the plaintext password in SMTPListenerAgent.exe.config. Subsequent restarts will decrypt the token automatically.

Security Policies & Anti-Abuse Controls

The SMTP Listener includes multi-layered controls to prevent unauthorized relay abuse, forged identities, and spoofing attacks.

1. Inbound & Outbound Domain Whitelisting

Domain filtering operates at the SMTP protocol envelope level before the message body is accepted:

<SMTPServer>
  <!-- Only accept incoming emails sent from these trusted corporate domains -->
  <add key="enableIncomingDomainFiltering" value="1" />
  <add key="allowIncomingDomains" value="contoso.com,partnerclinic.org,hq.internal" />

  <!-- Only allow faxes addressed to your dedicated fax domain -->
  <add key="enableOutgoingDomainFiltering" value="1" />
  <add key="allowOutgoingDomains" value="fax.contoso.com" />
</SMTPServer>

Incoming Domain Filtering: Evaluates the client's MAIL FROM:<user@domain.com>. If the domain is not in allowIncomingDomains, the server returns a 550 Relaying Denied protocol rejection.
Outgoing Domain Filtering: Evaluates the recipient address RCPT TO:<faxnumber@faxdomain.com>. If the recipient domain does not match allowOutgoingDomains, delivery is rejected.

2. SPF (Sender Policy Framework) Validation

When isValidationEnabled="1" and enableSpfValidation="1", the SMTP Listener performs automated SPF verification:

Extracts the sender domain from the From header.
Identifies the originating client IP address from transmission metadata and Received headers.
Performs a DNS query for the domain's SPF record (TXT record beginning with v=spf1).
Evaluates ip4, ip6, a, mx, include, and redirect mechanisms against the sending IP.
If the sender IP is authorized by the domain's published SPF policy, the message passes. If unauthorized or spoofed, the message fails and is immediately routed to xlistener\smtp\spam.

3. DKIM (DomainKeys Identified Mail) Verification

When isValidationEnabled="1" and enableDkimValidation="1", the service verifies cryptographic message integrity:

Reads the DKIM-Signature: header from the .eml file.
Extracts the signing domain (d=) and selector (s=).
Queries DNS for the public key at <selector>._domainkey.<domain>.
Uses asymmetric cryptography (RSA / Ed25519) to verify that the message body and headers were not tampered with in transit.
If valid, the email moves to smtpgatewayDirectory. If the signature is invalid, missing, or corrupt, the email is quarantined in spamDirectory.

Mail Server Integration Walkthroughs

Scenario A: Microsoft 365 (Exchange Online) Connector

To route Email-to-Fax messages from Microsoft 365 to the FaxCore SMTP Listener:

Open the Exchange Admin Center (https://admin.exchange.microsoft.com).
Navigate to Mail flow > Connectors.
Click Add a connector:
- Connection from: Office 365
- Connection to: Your organization's email server
- Name: M365 to FaxCore SMTP Listener
Use of connector: Select Only when email messages are sent to these domains and add your dedicated fax domain (e.g., fax.contoso.com).
Routing method: Select Route email through these smart hosts and enter your FaxCore server's public FQDN or static IP address (e.g., fax.contoso.com).
Security restrictions: Select Always use Transport Layer Security (TLS) and choose Issued by a trusted certificate authority (CA), ensuring your certificate subject name matches the FQDN.
Complete validation and enable the connector.

Scenario B: Microsoft Exchange Server (On-Premises)

On your Exchange Hub Transport / Mailbox Server:

Method 1: Exchange Management Shell (PowerShell)

Create a dedicated Send Connector routed to the FaxCore SMTP Listener:

New-SendConnector -Name "FaxCore SMTP Listener Connector" `
    -Usage Custom `
    -AddressSpaces "SMTP:fax.contoso.com;1" `
    -IsScopedConnector $false `
    -DNSRoutingEnabled $false `
    -SmartHosts "[192.168.10.50]" `
    -SmartHostAuthMechanism None `
    -Port 25

(Replace 192.168.10.50 with your FaxCore server's LAN IP and fax.contoso.com with your fax domain).

Method 2: Supporting Outlook `[FAX:Name@Number]` Format

To support legacy business contacts formatted as [FAX:Name@Number]:

New-SendConnector -Name "FaxCore Address Space Connector" `
    -Usage Custom `
    -AddressSpaces "FAX:*;1" `
    -DNSRoutingEnabled $false `
    -SmartHosts "[192.168.10.50]" `
    -SmartHostAuthMechanism None

Diagnostics, Event IDs & Troubleshooting

Log File Analysis

The primary diagnostic log is located at:

C:\FaxCore\svc.SMTPListenerAgent\log\SMTPListener.txt

Log entries include thread identifiers, timestamps, and log levels:

2026-10-08 14:02:11,402 [Main] INFO  SMTPListener - Base directory: C:\FaxCore\svc.SMTPListenerAgent\xlistener\smtp
2026-10-08 14:02:11,510 [Main] INFO  CertificateStoreLoader - [TLS_CERTSTORE] TLS certificate loaded from store: subject='CN=fax.contoso.com', thumbprint=3FA28D9102B..., notBefore=2026-01-01 00:00:00Z, notAfter=2027-01-01 23:59:59Z
2026-10-08 14:02:11,525 [Main] INFO  SMTPListener - SMTP endpoint: port 25 (STARTTLS)
2026-10-08 14:02:11,526 [Main] INFO  SMTPListener - SMTP endpoint: port 587 (STARTTLS)
2026-10-08 14:02:11,528 [Main] INFO  SMTPListener - SMTP endpoint: port 465 (implicit TLS)
2026-10-08 14:02:11,530 [Main] INFO  SMTPListener - SMTP server connected.
2026-10-08 14:05:22,110 [ThreadPool-3] INFO  SMTPListener - Watch event Created - file: e4b238d1-76a0-4b21-8840-02a8bf30a1c1.eml
2026-10-08 14:05:22,115 [ThreadPool-3] INFO  SMTPListener - Archive copy saved: C:\FaxCore\svc.SMTPListenerAgent\xlistener\smtp\complete\e4b238d1-76a0-4b21-8840-02a8bf30a1c1.eml
2026-10-08 14:05:22,120 [ThreadPool-3] INFO  SMTPListener - File e4b238d1-76a0-4b21-8840-02a8bf30a1c1.eml passed validation, moved to SMTPGateway

Windows Event Log Reference

The SMTP Listener logs critical system events to the Windows Application Log under source SMTP server setup:

Event ID	Event Identifier	Description & Resolution Action
168	`CERTPWD_PLAINTEXT`	Unencrypted Password Detected: The `certificatePassword` in `App.config` is plain text. The event description provides the encrypted cipher. Replace the config value with the provided ciphertext.
169	`SMTP_SETUP_ERROR`	Network Socket / Binding Failure: The listener failed to bind to configured ports. Verify that no competing service (such as IIS SMTP or an existing mail daemon) is holding port 25 or 587.
172	`CERTSTORE_NOTFOUND`	Certificate Not Found in Store: No certificate matching `certificateSubjectName` was found in `Certificates (Local Computer) \ Personal`. Verify the name or inspect `certlm.msc`.
173	`CERTSTORE_NOVALID`	Certificate Expired or Inactive: One or more certificates matched the subject name, but all are expired or not yet valid. Install a renewed certificate in `certlm.msc`.
174	`CERTSTORE_NOKEY`	Private Key Permission Denied: The certificate exists, but the Windows service account running `FXC6.SMTPListener` lacks permission to access the private key. Open `certlm.msc` > Manage Private Keys and add Read permission.

Troubleshooting Checklist

1. Port Conflict on Port 25

If the service fails to start with socket errors, check for other processes listening on port 25:

Get-NetTCPConnection -LocalPort 25 -ErrorAction SilentlyContinue | Select-Object LocalAddress, LocalPort, OwningProcess

If a PID is returned, inspect the process in Task Manager and disable the conflicting SMTP service (e.g., legacy IIS SMTP service SMTPSVC).

2. Testing Port Reachability & STARTTLS

From another machine or mail server, test basic network connectivity:

Test-NetConnection -ComputerName faxcore.yourdomain.com -Port 25

Or test the full SMTP conversation via PowerShell:

Send-MailMessage -From "sender@contoso.com" `
                 -To "17208704141@fax.contoso.com" `
                 -Subject "Test Fax" `
                 -Body "Testing SMTP Listener" `
                 -SmtpServer "faxcore.yourdomain.com" `
                 -Port 25

3. Quarantined Emails in `spam\`

If expected faxes are not sending, check C:\FaxCore\svc.SMTPListenerAgent\xlistener\smtp\spam:

Check SMTPListener.txt for Email validation failed for {file} - SPF:FAIL DKIM:FAIL.
If testing from internal servers without public SPF records, temporarily set isValidationEnabled="0" in <SMTP> to confirm message ingestion before tuning DNS records.

Email to Fax (Exchange & SMTP) — Outbound and inbound email fax addressing syntax, Outlook formats, and SMTPGatewayAgent settings.
Domain SMTP Relay Settings — Outbound SMTP relay provider configuration (M365 Modern Auth, AWS SES, Mailgun, SendGrid).
System Logs & Diagnostics — General log retention and troubleshooting service events in FaxCore eV6.

Table of Contents

FaxCore SMTP Listener Service (FXC6.SMTPListenerAgent)

Key Capabilities & Evolution

Comparison: Legacy IIS SMTP vs. FaxCore SMTP Listener

Architectural Message Flow

Stage-by-Stage Processing Lifecycle

Directory Structure

Note

Service Installation & Control

Managing via Windows Services (services.msc)

Managing via PowerShell

Topshelf Command-Line Commands

Tip

Configuration Reference (SMTPListenerAgent.exe.config)

Complete Configuration Template

Section 1: <SMTP> (Storage & Email Validation Engine)

Section 2: <SMTPServer> (Network Endpoints & Access Control)

TLS/SSL Encryption & Certificate Setup

Method 1: Windows Certificate Store Binding (Recommended)

Step 1: Install the Certificate

Step 2: Grant Service Account Private Key Permissions

Step 3: Configure SMTPListenerAgent.exe.config

Note

Method 2: Standalone PFX Certificate File

Automated Password Encryption

Security Policies & Anti-Abuse Controls

1. Inbound & Outbound Domain Whitelisting

2. SPF (Sender Policy Framework) Validation

3. DKIM (DomainKeys Identified Mail) Verification

Mail Server Integration Walkthroughs

Scenario A: Microsoft 365 (Exchange Online) Connector

Scenario B: Microsoft Exchange Server (On-Premises)

Method 1: Exchange Management Shell (PowerShell)

Method 2: Supporting Outlook [FAX:Name@Number] Format

Diagnostics, Event IDs & Troubleshooting

Log File Analysis

Windows Event Log Reference

Troubleshooting Checklist

1. Port Conflict on Port 25

2. Testing Port Reachability & STARTTLS

3. Quarantined Emails in spam\

Related Documentation

FaxCore SMTP Listener Service (`FXC6.SMTPListenerAgent`)

Managing via Windows Services (`services.msc`)

Configuration Reference (`SMTPListenerAgent.exe.config`)

Section 1: `<SMTP>` (Storage & Email Validation Engine)

Section 2: `<SMTPServer>` (Network Endpoints & Access Control)

Step 3: Configure `SMTPListenerAgent.exe.config`

Method 2: Supporting Outlook `[FAX:Name@Number]` Format

3. Quarantined Emails in `spam\`