Dateien nach "/" hochladen

SMTPGraphRelay.ps1

@@ -7,7 +7,7 @@
   Nimmt lokale SMTP-Mails an, speichert sie als .eml in einer Queue und sendet sie
   anschließend per Microsoft Graph sendMail mit App-only Zertifikatsauthentifizierung.
 
-  V1.6: Queue-ID/Received/Message-ID sowie SMTP-/Queue-Backpressure und Session-Limits
+  V1.7: SMTP AUTH LOGIN/PLAIN mit PBKDF2-SHA256, Benutzer-/Session-Schutz und V1.6 Queue-/Backpressure-Funktionen
 #>
 
 [CmdletBinding()]
@@ -809,6 +809,319 @@ function Add-RelayMessageHeaders {
     return $result
 }
 
+
+function Test-AddressInList {
+    param(
+        [Parameter(Mandatory)][System.Net.IPAddress]$Address,
+        [object[]]$Entries
+    )
+
+    foreach ($entry in @($Entries)) {
+        if ($null -eq $entry) { continue }
+
+        $value = [string]$entry
+        if ([string]::IsNullOrWhiteSpace($value)) { continue }
+
+        if ($value -eq "*") { return $true }
+
+        try {
+            if ($value -match '/') {
+                if (Test-IPv4InCidr -Address $Address -Cidr $value) {
+                    return $true
+                }
+            }
+            elseif ([System.Net.IPAddress]::Parse($value).Equals($Address)) {
+                return $true
+            }
+        }
+        catch {}
+    }
+
+    return $false
+}
+
+function Get-SmtpAuthSettings {
+    $requireAuth = $false
+    $maxFailures = 5
+    $allowUnauthenticatedNetworks = @()
+    $users = @()
+
+    try {
+        if ($script:Config.Smtp.PSObject.Properties.Name -contains "RequireAuth") {
+            $requireAuth = [bool]$script:Config.Smtp.RequireAuth
+        }
+
+        if ($script:Config.Smtp.PSObject.Properties.Name -contains "AuthMaxFailures") {
+            $v = [int]$script:Config.Smtp.AuthMaxFailures
+            if ($v -ge 1 -and $v -le 100) {
+                $maxFailures = $v
+            }
+        }
+
+        if ($script:Config.Smtp.PSObject.Properties.Name -contains "AllowUnauthenticatedNetworks") {
+            $allowUnauthenticatedNetworks = @($script:Config.Smtp.AllowUnauthenticatedNetworks)
+        }
+
+        if ($script:Config.Smtp.PSObject.Properties.Name -contains "AuthUsers") {
+            $users = @($script:Config.Smtp.AuthUsers)
+        }
+    }
+    catch {}
+
+    return [pscustomobject]@{
+        RequireAuth = $requireAuth
+        AuthMaxFailures = $maxFailures
+        AllowUnauthenticatedNetworks = $allowUnauthenticatedNetworks
+        Users = $users
+    }
+}
+
+function Test-SmtpAuthenticationRequired {
+    param([Parameter(Mandatory)][System.Net.IPAddress]$Address)
+
+    $settings = Get-SmtpAuthSettings
+
+    if (-not $settings.RequireAuth) {
+        return $false
+    }
+
+    if (Test-AddressInList -Address $Address -Entries $settings.AllowUnauthenticatedNetworks) {
+        return $false
+    }
+
+    return $true
+}
+
+function ConvertFrom-Base64Utf8 {
+    param([Parameter(Mandatory)][string]$Value)
+
+    try {
+        $bytes = [Convert]::FromBase64String($Value)
+        return [Text.Encoding]::UTF8.GetString($bytes)
+    }
+    catch {
+        throw "Invalid Base64 data"
+    }
+}
+
+function Invoke-Pbkdf2Sha256 {
+    param(
+        [Parameter(Mandatory)][string]$Password,
+        [Parameter(Mandatory)][byte[]]$Salt,
+        [Parameter(Mandatory)][int]$Iterations,
+        [int]$Length = 32
+    )
+
+    if ($Iterations -lt 1) {
+        throw "Iterations must be greater than zero."
+    }
+
+    # Auf unterstützten .NET-Framework-Versionen verwenden wir die native,
+    # schnelle PBKDF2-SHA256-Implementierung.
+    try {
+        $derive = New-Object System.Security.Cryptography.Rfc2898DeriveBytes(
+            $Password,
+            $Salt,
+            $Iterations,
+            [System.Security.Cryptography.HashAlgorithmName]::SHA256
+        )
+
+        try {
+            return $derive.GetBytes($Length)
+        }
+        finally {
+            $derive.Dispose()
+        }
+    }
+    catch {
+        # Kompatibilitäts-Fallback für ältere .NET-Framework-Stände.
+        $hmac = New-Object System.Security.Cryptography.HMACSHA256
+        $hmac.Key = [Text.Encoding]::UTF8.GetBytes($Password)
+
+        try {
+            $hashLength = 32
+            $blocks = [Math]::Ceiling($Length / [double]$hashLength)
+            $output = New-Object byte[] ($blocks * $hashLength)
+            $offset = 0
+
+            for ($block = 1; $block -le $blocks; $block++) {
+                $blockBytes = [BitConverter]::GetBytes([int]$block)
+                if ([BitConverter]::IsLittleEndian) {
+                    [Array]::Reverse($blockBytes)
+                }
+
+                $input = New-Object byte[] ($Salt.Length + 4)
+                [Array]::Copy($Salt, 0, $input, 0, $Salt.Length)
+                [Array]::Copy($blockBytes, 0, $input, $Salt.Length, 4)
+
+                $u = $hmac.ComputeHash($input)
+                $t = New-Object byte[] $u.Length
+                [Array]::Copy($u, $t, $u.Length)
+
+                for ($i = 2; $i -le $Iterations; $i++) {
+                    $u = $hmac.ComputeHash($u)
+                    for ($j = 0; $j -lt $t.Length; $j++) {
+                        $t[$j] = $t[$j] -bxor $u[$j]
+                    }
+                }
+
+                [Array]::Copy($t, 0, $output, $offset, $t.Length)
+                $offset += $t.Length
+            }
+
+            $result = New-Object byte[] $Length
+            [Array]::Copy($output, 0, $result, 0, $Length)
+            return $result
+        }
+        finally {
+            $hmac.Dispose()
+        }
+    }
+}
+
+function Test-FixedTimeEquals {
+    param(
+        [Parameter(Mandatory)][byte[]]$A,
+        [Parameter(Mandatory)][byte[]]$B
+    )
+
+    if ($A.Length -ne $B.Length) {
+        return $false
+    }
+
+    [int]$difference = 0
+    for ($i = 0; $i -lt $A.Length; $i++) {
+        $difference = $difference -bor ($A[$i] -bxor $B[$i])
+    }
+
+    return ($difference -eq 0)
+}
+
+function Test-SmtpCredentials {
+    param(
+        [Parameter(Mandatory)][string]$Username,
+        [Parameter(Mandatory)][string]$Password
+    )
+
+    if ([string]::IsNullOrWhiteSpace($Username)) {
+        return $false
+    }
+
+    $settings = Get-SmtpAuthSettings
+    $user = $settings.Users |
+        Where-Object { ([string]$_.Username).Equals($Username, [StringComparison]::OrdinalIgnoreCase) } |
+        Select-Object -First 1
+
+    if (-not $user) {
+        # Bewusst keine Unterscheidung im SMTP-Result zwischen unbekanntem
+        # Benutzer und falschem Passwort.
+        return $false
+    }
+
+    try {
+        $salt = [Convert]::FromBase64String([string]$user.Salt)
+        $expected = [Convert]::FromBase64String([string]$user.PasswordHash)
+        $iterations = [int]$user.Iterations
+
+        if ($iterations -lt 10000 -or $expected.Length -lt 16 -or $salt.Length -lt 8) {
+            return $false
+        }
+
+        $actual = Invoke-Pbkdf2Sha256 `
+            -Password $Password `
+            -Salt $salt `
+            -Iterations $iterations `
+            -Length $expected.Length
+
+        return (Test-FixedTimeEquals -A $actual -B $expected)
+    }
+    catch {
+        return $false
+    }
+}
+
+function Invoke-SmtpAuthLogin {
+    param(
+        [Parameter(Mandatory)][System.IO.StreamReader]$Reader,
+        [Parameter(Mandatory)][System.IO.StreamWriter]$Writer,
+        [string]$InitialResponse
+    )
+
+    try {
+        if ([string]::IsNullOrWhiteSpace($InitialResponse)) {
+            Write-SmtpLine $Writer "334 VXNlcm5hbWU6"
+            $encodedUser = $Reader.ReadLine()
+            if ($null -eq $encodedUser) { throw "Client disconnected during AUTH LOGIN" }
+        }
+        else {
+            $encodedUser = $InitialResponse
+        }
+
+        $username = ConvertFrom-Base64Utf8 -Value $encodedUser
+
+        Write-SmtpLine $Writer "334 UGFzc3dvcmQ6"
+        $encodedPassword = $Reader.ReadLine()
+        if ($null -eq $encodedPassword) { throw "Client disconnected during AUTH LOGIN" }
+
+        $password = ConvertFrom-Base64Utf8 -Value $encodedPassword
+
+        return [pscustomobject]@{
+            Valid = (Test-SmtpCredentials -Username $username -Password $password)
+            Username = $username
+            ProtocolError = $false
+        }
+    }
+    catch {
+        return [pscustomobject]@{
+            Valid = $false
+            Username = $null
+            ProtocolError = $true
+        }
+    }
+}
+
+function Invoke-SmtpAuthPlain {
+    param(
+        [Parameter(Mandatory)][System.IO.StreamReader]$Reader,
+        [Parameter(Mandatory)][System.IO.StreamWriter]$Writer,
+        [string]$InitialResponse
+    )
+
+    try {
+        $encoded = $InitialResponse
+
+        if ([string]::IsNullOrWhiteSpace($encoded)) {
+            Write-SmtpLine $Writer "334"
+            $encoded = $Reader.ReadLine()
+            if ($null -eq $encoded) { throw "Client disconnected during AUTH PLAIN" }
+        }
+
+        $decoded = ConvertFrom-Base64Utf8 -Value $encoded
+        $parts = $decoded -split "`0", 3
+
+        if ($parts.Count -lt 3) {
+            throw "Invalid AUTH PLAIN payload"
+        }
+
+        # RFC 4616: [authzid] NUL authcid NUL passwd
+        $username = $parts[1]
+        $password = $parts[2]
+
+        return [pscustomobject]@{
+            Valid = (Test-SmtpCredentials -Username $username -Password $password)
+            Username = $username
+            ProtocolError = $false
+        }
+    }
+    catch {
+        return [pscustomobject]@{
+            Valid = $false
+            Username = $null
+            ProtocolError = $true
+        }
+    }
+}
+
 function Get-SmtpLimits {
     $maxRecipients = 50
     $maxMessagesPerConnection = 25
@@ -933,6 +1246,8 @@ function Save-SmtpMessage {
         [Parameter(Mandatory)]
         [string]$RemoteAddress,
 
+        [string]$AuthenticatedUser,
+
         [string]$QueueId
     )
 
@@ -961,6 +1276,7 @@ function Save-SmtpMessage {
         QueueId = $QueueId
         ReceivedUtc = [DateTime]::UtcNow.ToString("o")
         RemoteAddress = $RemoteAddress
+        AuthenticatedUser = $AuthenticatedUser
         EnvelopeFrom = $MailFrom
         EnvelopeRecipients = @($Recipients)
         RetryCount = 0
@@ -985,7 +1301,8 @@ function Save-SmtpMessage {
         throw
     }
 
-    Write-Log "[$QueueId] Mail angenommen | Von=$MailFrom | An=$($Recipients -join ', ') | Client=$RemoteAddress"
+    $authText = if ([string]::IsNullOrWhiteSpace($AuthenticatedUser)) { "unauthenticated" } else { $AuthenticatedUser }
+    Write-Log "[$QueueId] Mail angenommen | Von=$MailFrom | An=$($Recipients -join ', ') | Client=$RemoteAddress | Auth=$authText"
     return [pscustomobject]@{
         QueueId = $QueueId
         Path = $pendingEml
@@ -1016,6 +1333,7 @@ function Handle-SmtpClient {
             $writer.AutoFlush = $true
             Write-SmtpLine $writer "554 5.7.1 Client not allowed"
         } catch {}
+
         $Client.Close()
         Write-Log "Client abgewiesen: $remoteIp" "WARN"
         return
@@ -1023,8 +1341,22 @@ function Handle-SmtpClient {
 
     $stream = $Client.GetStream()
     $stream.ReadTimeout = [int]$script:Config.Smtp.ClientTimeoutSeconds * 1000
-    $reader = New-Object System.IO.StreamReader($stream, [System.Text.Encoding]::UTF8, $true, 4096, $true)
+
-    $writer = New-Object System.IO.StreamWriter($stream, [System.Text.Encoding]::ASCII, 4096, $true)
+    $reader = New-Object System.IO.StreamReader(
+        $stream,
+        [System.Text.Encoding]::UTF8,
+        $true,
+        4096,
+        $true
+    )
+
+    $writer = New-Object System.IO.StreamWriter(
+        $stream,
+        [System.Text.Encoding]::ASCII,
+        4096,
+        $true
+    )
+
     $writer.NewLine = "`r`n"
     $writer.AutoFlush = $true
 
@@ -1032,6 +1364,14 @@ function Handle-SmtpClient {
     $recipients = New-Object System.Collections.Generic.List[string]
     $acceptedMessages = 0
     $limits = Get-SmtpLimits
+    $authSettings = Get-SmtpAuthSettings
+
+    $authenticated = $false
+    $authenticatedUser = $null
+    $authFailures = 0
+    $authLocked = $false
+    $authRequired = Test-SmtpAuthenticationRequired -Address $remoteIp
+    $authAvailable = (@($authSettings.Users).Count -gt 0)
 
     Write-SmtpLine $writer ("220 {0} SMTPGraphRelay ready" -f $script:Config.Smtp.Hostname)
 
@@ -1040,12 +1380,112 @@ function Handle-SmtpClient {
             $line = $reader.ReadLine()
             if ($null -eq $line) { break }
 
-            if ($line -match '^(?i)(EHLO|HELO)\s+(.+)$') {
+            if ($line -match '^(?i)EHLO\s+(.+)$') {
                 Write-SmtpLine $writer ("250-{0}" -f $script:Config.Smtp.Hostname)
                 Write-SmtpLine $writer ("250-SIZE {0}" -f ([int64]$script:Config.Smtp.MaxMessageSizeMB * 1024 * 1024))
+
+                if ($authAvailable) {
+                    Write-SmtpLine $writer "250-AUTH LOGIN PLAIN"
+                }
+
                 Write-SmtpLine $writer "250 8BITMIME"
             }
+            elseif ($line -match '^(?i)HELO\s+(.+)$') {
+                Write-SmtpLine $writer ("250 {0}" -f $script:Config.Smtp.Hostname)
+            }
+            elseif ($line -match '^(?i)AUTH\s+LOGIN(?:\s+(\S+))?\s*$') {
+                if (-not $authAvailable) {
+                    Write-SmtpLine $writer "504 5.7.4 Authentication mechanism unavailable"
+                    continue
+                }
+
+                if ($authenticated) {
+                    Write-SmtpLine $writer "503 5.5.0 Already authenticated"
+                    continue
+                }
+
+                if ($authLocked) {
+                    Write-SmtpLine $writer "454 4.7.0 Too many authentication failures"
+                    continue
+                }
+
+                $initial = $matches[1]
+                $result = Invoke-SmtpAuthLogin -Reader $reader -Writer $writer -InitialResponse $initial
+
+                if ($result.ProtocolError) {
+                    $authFailures++
+                    Write-SmtpLine $writer "501 5.5.2 Invalid authentication data"
+                }
+                elseif ($result.Valid) {
+                    $authenticated = $true
+                    $authenticatedUser = $result.Username
+                    $authFailures = 0
+                    Write-SmtpLine $writer "235 2.7.0 Authentication successful"
+                    Write-Log ("SMTP-AUTH LOGIN erfolgreich | Client={0} | Benutzer={1}" -f $remoteIp, $authenticatedUser)
+                    continue
+                }
+                else {
+                    $authFailures++
+                    Write-SmtpLine $writer "535 5.7.8 Authentication credentials invalid"
+                    Write-Log ("SMTP-AUTH LOGIN fehlgeschlagen | Client={0} | Benutzer={1}" -f $remoteIp, $result.Username) "WARN"
+                }
+
+                if ($authFailures -ge $authSettings.AuthMaxFailures) {
+                    $authLocked = $true
+                    Write-Log ("SMTP-AUTH gesperrt nach {0} Fehlversuchen | Client={1}" -f $authFailures, $remoteIp) "WARN"
+                }
+            }
+            elseif ($line -match '^(?i)AUTH\s+PLAIN(?:\s+(\S+))?\s*$') {
+                if (-not $authAvailable) {
+                    Write-SmtpLine $writer "504 5.7.4 Authentication mechanism unavailable"
+                    continue
+                }
+
+                if ($authenticated) {
+                    Write-SmtpLine $writer "503 5.5.0 Already authenticated"
+                    continue
+                }
+
+                if ($authLocked) {
+                    Write-SmtpLine $writer "454 4.7.0 Too many authentication failures"
+                    continue
+                }
+
+                $initial = $matches[1]
+                $result = Invoke-SmtpAuthPlain -Reader $reader -Writer $writer -InitialResponse $initial
+
+                if ($result.ProtocolError) {
+                    $authFailures++
+                    Write-SmtpLine $writer "501 5.5.2 Invalid authentication data"
+                }
+                elseif ($result.Valid) {
+                    $authenticated = $true
+                    $authenticatedUser = $result.Username
+                    $authFailures = 0
+                    Write-SmtpLine $writer "235 2.7.0 Authentication successful"
+                    Write-Log ("SMTP-AUTH PLAIN erfolgreich | Client={0} | Benutzer={1}" -f $remoteIp, $authenticatedUser)
+                    continue
+                }
+                else {
+                    $authFailures++
+                    Write-SmtpLine $writer "535 5.7.8 Authentication credentials invalid"
+                    Write-Log ("SMTP-AUTH PLAIN fehlgeschlagen | Client={0} | Benutzer={1}" -f $remoteIp, $result.Username) "WARN"
+                }
+
+                if ($authFailures -ge $authSettings.AuthMaxFailures) {
+                    $authLocked = $true
+                    Write-Log ("SMTP-AUTH gesperrt nach {0} Fehlversuchen | Client={1}" -f $authFailures, $remoteIp) "WARN"
+                }
+            }
+            elseif ($line -match '^(?i)AUTH\b') {
+                Write-SmtpLine $writer "504 5.5.4 Unsupported authentication mechanism"
+            }
             elseif ($line -match '^(?i)MAIL FROM:\s*<([^>]*)>') {
+                if ($authRequired -and -not $authenticated) {
+                    Write-SmtpLine $writer "530 5.7.0 Authentication required"
+                    continue
+                }
+
                 if ($acceptedMessages -ge $limits.MaxMessagesPerConnection) {
                     Write-SmtpLine $writer "452 4.5.3 Too many messages in this session"
                     Write-Log ("SMTP-Session von {0}: Nachrichtenlimit {1} erreicht." -f $remoteIp, $limits.MaxMessagesPerConnection) "WARN"
@@ -1072,6 +1512,11 @@ function Handle-SmtpClient {
                 Write-SmtpLine $writer "250 2.1.5 OK"
             }
             elseif ($line -match '^(?i)DATA\s*$') {
+                if ($authRequired -and -not $authenticated) {
+                    Write-SmtpLine $writer "530 5.7.0 Authentication required"
+                    continue
+                }
+
                 if (-not $mailFrom -or $recipients.Count -eq 0) {
                     Write-SmtpLine $writer "503 5.5.1 Need MAIL FROM and RCPT TO first"
                     continue
@@ -1082,8 +1527,6 @@ function Handle-SmtpClient {
                     continue
                 }
 
-                # Backpressure VOR 354/DATA: Der Client soll große Nachrichtendaten
-                # gar nicht erst übertragen, wenn wir sie nicht sicher puffern können.
                 $pressure = Get-QueuePressure
                 if (-not $pressure.Accept) {
                     Write-SmtpLine $writer $pressure.SmtpCode
@@ -1092,6 +1535,7 @@ function Handle-SmtpClient {
                 }
 
                 Write-SmtpLine $writer "354 End data with <CR><LF>.<CR><LF>"
+
                 $data = New-Object System.Collections.Generic.List[string]
                 $size = 0
                 $maxBytes = [int64]$script:Config.Smtp.MaxMessageSizeMB * 1024 * 1024
@@ -1099,13 +1543,21 @@ function Handle-SmtpClient {
 
                 while ($true) {
                     $dataLine = $reader.ReadLine()
-                    if ($null -eq $dataLine) { throw "Client disconnected during DATA" }
-                    if ($dataLine -eq ".") { break }
 
-                    # SMTP dot-stuffing rückgängig machen
+                    if ($null -eq $dataLine) {
-                    if ($dataLine.StartsWith("..")) { $dataLine = $dataLine.Substring(1) }
+                        throw "Client disconnected during DATA"
+                    }
+
+                    if ($dataLine -eq ".") {
+                        break
+                    }
+
+                    if ($dataLine.StartsWith("..")) {
+                        $dataLine = $dataLine.Substring(1)
+                    }
 
                     $size += [System.Text.Encoding]::UTF8.GetByteCount($dataLine) + 2
+
                     if ($size -gt $maxBytes) {
                         $tooLarge = $true
                     }
@@ -1127,17 +1579,24 @@ function Handle-SmtpClient {
                             -MailFrom $mailFrom `
                             -Recipients $recipients.ToArray() `
                             -RemoteAddress $remoteIp.ToString() `
+                            -AuthenticatedUser $authenticatedUser `
                             -QueueId $queueId
 
                         $acceptedMessages++
-                        Write-SmtpLine $writer ("250 2.0.0 Message accepted for delivery; queue-id={0}" -f $saved.QueueId)
+
+                        Write-SmtpLine $writer (
+                            "250 2.0.0 Message accepted for delivery; queue-id={0}" -f $saved.QueueId
+                        )
                     }
                     catch {
-                        # Nach DATA darf niemals 250 gesendet werden, wenn die Queue-Datei
-                        # nicht vollständig und atomar gesichert werden konnte.
                         Write-SmtpLine $writer "451 4.3.0 SMTPGraphRelay queue temporarily unavailable"
-                        Write-Log ("[{0}] Queue-Speicherung fehlgeschlagen | Client={1} | Fehler={2}" -f `
+
-                            $queueId, $remoteIp, $_.Exception.Message) "ERROR"
+                        Write-Log (
+                            "[{0}] Queue-Speicherung fehlgeschlagen | Client={1} | Fehler={2}" -f `
+                            $queueId,
+                            $remoteIp,
+                            $_.Exception.Message
+                        ) "ERROR"
                     }
                 }
 
@@ -1156,7 +1615,7 @@ function Handle-SmtpClient {
                 Write-SmtpLine $writer "221 2.0.0 Bye"
                 break
             }
-            elseif ($line -match '^(?i)(AUTH|STARTTLS)\b') {
+            elseif ($line -match '^(?i)STARTTLS\b') {
                 Write-SmtpLine $writer "502 5.5.1 Command not implemented"
             }
             else {
@@ -1424,6 +1883,15 @@ $smtpFunctionNames = @(
     "Get-QueueDirectories",
     "New-QueueId",
     "Add-RelayMessageHeaders",
+    "Test-AddressInList",
+    "Get-SmtpAuthSettings",
+    "Test-SmtpAuthenticationRequired",
+    "ConvertFrom-Base64Utf8",
+    "Invoke-Pbkdf2Sha256",
+    "Test-FixedTimeEquals",
+    "Test-SmtpCredentials",
+    "Invoke-SmtpAuthLogin",
+    "Invoke-SmtpAuthPlain",
     "Get-SmtpLimits",
     "Get-QueuePressure",
     "Save-SmtpMessage",
@@ -1505,7 +1973,7 @@ $listenIp = [System.Net.IPAddress]::Parse($script:Config.Smtp.ListenAddress)
 $listener = [System.Net.Sockets.TcpListener]::new($listenIp, [int]$script:Config.Smtp.Port)
 $listener.Start()
 
-Write-Log "SMTPGraphRelay V1.6 gestartet auf $($script:Config.Smtp.ListenAddress):$($script:Config.Smtp.Port)"
+Write-Log "SMTPGraphRelay V1.7 gestartet auf $($script:Config.Smtp.ListenAddress):$($script:Config.Smtp.Port)"
 Write-Log "Graph-Absender: $($script:Config.Graph.SenderMailbox)"
 Write-Log "Maximale parallele SMTP-Verbindungen: $script:MaxConcurrentClients"
 Write-Log "Queue-/Graph-Worker läuft separat vom SMTP-Listener."
@@ -1516,6 +1984,11 @@ Write-Log ("SMTP-Limits: max. {0} Empfänger/Mail, {1} Mails/Verbindung." -f `
 Write-Log ("Backpressure: max. {0} Pending-Mails, mindestens {1} MB freier Speicher." -f `
     $limits.MaxPendingMessages, $limits.MinFreeDiskSpaceMB)
 
+$authSettings = Get-SmtpAuthSettings
+$authMode = if ($authSettings.RequireAuth) { "erforderlich" } else { "optional/deaktiviert" }
+Write-Log ("SMTP-AUTH: {0}; {1} Benutzer; max. {2} Fehlversuche/Verbindung." -f `
+    $authMode, @($authSettings.Users).Count, $authSettings.AuthMaxFailures)
+
 $logSettings = Get-LogSettings
 Write-Log ("Log-Rotation: max. {0} MB pro Datei, Aufbewahrung {1} Tage." -f `
     $logSettings.MaxFileSizeMB, $logSettings.RetentionDays)

Test-SMTPGraphRelay(1).ps1

@@ -0,0 +1,674 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Health Check für SMTPGraphRelay.
+
+.DESCRIPTION
+  Prüft die lokale SMTPGraphRelay-Installation ohne Änderungen vorzunehmen.
+
+  Standardprüfungen:
+  - Windows PowerShell 5.1
+  - Administratorstatus
+  - config.json
+  - Microsoft.Graph.Authentication Modul
+  - Zertifikat + Private Key + Ablaufdatum
+  - Verzeichnisse und Schreibrechte
+  - Scheduled Task
+  - SMTP Listener
+  - Queue / Failed Queue
+  - App-only Microsoft Graph Anmeldung
+
+  Optional:
+  - echte SMTP-Testmail über das lokale Relay
+
+.EXAMPLE
+  .\Test-SMTPGraphRelay.ps1
+
+.EXAMPLE
+  .\Test-SMTPGraphRelay.ps1 -SendTestMail -TestRecipient manuel.maier@maieredv.de
+#>
+
+[CmdletBinding()]
+param(
+    [string]$ConfigPath = "$PSScriptRoot\config.json",
+
+    [switch]$SendTestMail,
+
+    [string]$TestRecipient,
+
+    [string]$SmtpUsername,
+
+    [int]$QueueWarningAgeMinutes = 30,
+
+    [int]$FailedWarningCount = 1
+)
+
+$ErrorActionPreference = "Stop"
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+
+$script:OkCount = 0
+$script:WarnCount = 0
+$script:FailCount = 0
+
+function Write-Result {
+    param(
+        [Parameter(Mandatory)]
+        [ValidateSet("OK","WARN","FAIL","INFO")]
+        [string]$Status,
+
+        [Parameter(Mandatory)]
+        [string]$Message
+    )
+
+    switch ($Status) {
+        "OK" {
+            $script:OkCount++
+            Write-Host "[OK]   $Message" -ForegroundColor Green
+        }
+        "WARN" {
+            $script:WarnCount++
+            Write-Host "[WARN] $Message" -ForegroundColor Yellow
+        }
+        "FAIL" {
+            $script:FailCount++
+            Write-Host "[FAIL] $Message" -ForegroundColor Red
+        }
+        "INFO" {
+            Write-Host "[INFO] $Message" -ForegroundColor Cyan
+        }
+    }
+}
+
+function Resolve-ConfigPath {
+    param([Parameter(Mandatory)][string]$Path)
+
+    if ([IO.Path]::IsPathRooted($Path)) {
+        return $Path
+    }
+
+    return Join-Path $PSScriptRoot $Path
+}
+
+function Test-IsAdministrator {
+    try {
+        $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+        $principal = New-Object Security.Principal.WindowsPrincipal($identity)
+        return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+    }
+    catch {
+        return $false
+    }
+}
+
+function Test-DirectoryWritable {
+    param([Parameter(Mandatory)][string]$Path)
+
+    try {
+        if (-not (Test-Path -LiteralPath $Path)) {
+            return $false
+        }
+
+        $testFile = Join-Path $Path (".healthcheck-{0}.tmp" -f [guid]::NewGuid().ToString("N"))
+        [IO.File]::WriteAllText($testFile, "SMTPGraphRelay health check")
+        Remove-Item -LiteralPath $testFile -Force
+        return $true
+    }
+    catch {
+        return $false
+    }
+}
+
+function Send-RawSmtpTestMail {
+    param(
+        [Parameter(Mandatory)][string]$Server,
+        [Parameter(Mandatory)][int]$Port,
+        [Parameter(Mandatory)][string]$From,
+        [Parameter(Mandatory)][string]$To,
+        [string]$Username,
+        [string]$Password
+    )
+
+    $client = New-Object System.Net.Sockets.TcpClient
+
+    try {
+        $connect = $client.BeginConnect($Server, $Port, $null, $null)
+
+        if (-not $connect.AsyncWaitHandle.WaitOne(5000)) {
+            throw "Timeout beim Verbindungsaufbau zu $Server`:$Port"
+        }
+
+        $client.EndConnect($connect)
+
+        $stream = $client.GetStream()
+        $stream.ReadTimeout = 5000
+        $stream.WriteTimeout = 5000
+
+        $reader = New-Object System.IO.StreamReader($stream, [System.Text.Encoding]::ASCII)
+        $writer = New-Object System.IO.StreamWriter($stream, [System.Text.Encoding]::ASCII)
+        $writer.NewLine = "`r`n"
+        $writer.AutoFlush = $true
+
+        function Read-SmtpResponse {
+            param([int[]]$ExpectedCodes)
+
+            $lines = New-Object System.Collections.Generic.List[string]
+
+            while ($true) {
+                $line = $reader.ReadLine()
+
+                if ($null -eq $line) {
+                    throw "SMTP-Verbindung unerwartet geschlossen."
+                }
+
+                $lines.Add($line)
+
+                if ($line -match '^(\d{3})([ -])') {
+                    $code = [int]$matches[1]
+                    $separator = $matches[2]
+
+                    if ($separator -eq " ") {
+                        if ($ExpectedCodes -notcontains $code) {
+                            throw "Unerwartete SMTP-Antwort: $($lines -join ' | ')"
+                        }
+
+                        return ($lines -join " | ")
+                    }
+                }
+            }
+        }
+
+        [void](Read-SmtpResponse -ExpectedCodes @(220))
+
+        $writer.WriteLine("EHLO localhost")
+        [void](Read-SmtpResponse -ExpectedCodes @(250))
+
+        if (-not [string]::IsNullOrWhiteSpace($Username)) {
+            $writer.WriteLine("AUTH LOGIN")
+            [void](Read-SmtpResponse -ExpectedCodes @(334))
+
+            $writer.WriteLine([Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($Username)))
+            [void](Read-SmtpResponse -ExpectedCodes @(334))
+
+            $writer.WriteLine([Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($Password)))
+            [void](Read-SmtpResponse -ExpectedCodes @(235))
+        }
+
+        $writer.WriteLine("MAIL FROM:<$From>")
+        [void](Read-SmtpResponse -ExpectedCodes @(250))
+
+        $writer.WriteLine("RCPT TO:<$To>")
+        [void](Read-SmtpResponse -ExpectedCodes @(250))
+
+        $writer.WriteLine("DATA")
+        [void](Read-SmtpResponse -ExpectedCodes @(354))
+
+        $subject = "SMTPGraphRelay Health Check $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
+
+        $writer.WriteLine("From: <$From>")
+        $writer.WriteLine("To: <$To>")
+        $writer.WriteLine("Subject: $subject")
+        $writer.WriteLine("Date: $([DateTime]::Now.ToString('ddd, dd MMM yyyy HH:mm:ss zzz', [Globalization.CultureInfo]::InvariantCulture))")
+        $writer.WriteLine("Message-ID: <$([guid]::NewGuid().ToString('N'))@smtpgraphrelay-healthcheck>")
+        $writer.WriteLine("MIME-Version: 1.0")
+        $writer.WriteLine("Content-Type: text/plain; charset=utf-8")
+        $writer.WriteLine("")
+        $writer.WriteLine("SMTPGraphRelay Health Check")
+        $writer.WriteLine("")
+        $writer.WriteLine("Zeit: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')")
+        $writer.WriteLine("Host: $env:COMPUTERNAME")
+        $writer.WriteLine(".")
+        [void](Read-SmtpResponse -ExpectedCodes @(250))
+
+        $writer.WriteLine("QUIT")
+        [void](Read-SmtpResponse -ExpectedCodes @(221))
+
+        return $true
+    }
+    finally {
+        try { $client.Close() } catch {}
+    }
+}
+
+Write-Host ""
+Write-Host "==========================================================" -ForegroundColor Cyan
+Write-Host " SMTPGraphRelay - Health Check" -ForegroundColor Cyan
+Write-Host "==========================================================" -ForegroundColor Cyan
+Write-Host ""
+
+# ---------------------------------------------------------------------------
+# PowerShell / Rechte
+# ---------------------------------------------------------------------------
+if ($PSVersionTable.PSEdition -eq "Desktop" -and $PSVersionTable.PSVersion.Major -eq 5) {
+    Write-Result OK "Windows PowerShell $($PSVersionTable.PSVersion) erkannt."
+}
+else {
+    Write-Result FAIL "Dieses Tool sollte mit Windows PowerShell 5.1 laufen. Erkannt: $($PSVersionTable.PSEdition) $($PSVersionTable.PSVersion)"
+}
+
+if (Test-IsAdministrator) {
+    Write-Result OK "PowerShell läuft als Administrator."
+}
+else {
+    Write-Result WARN "PowerShell läuft nicht als Administrator. Einige Prüfungen können eingeschränkt sein."
+}
+
+# ---------------------------------------------------------------------------
+# Config
+# ---------------------------------------------------------------------------
+if (-not (Test-Path -LiteralPath $ConfigPath)) {
+    Write-Result FAIL "config.json nicht gefunden: $ConfigPath"
+    Write-Host ""
+    Write-Host "Health Check abgebrochen, da ohne Config keine weiteren Prüfungen möglich sind." -ForegroundColor Red
+    exit 2
+}
+
+try {
+    $config = Get-Content -LiteralPath $ConfigPath -Raw -Encoding UTF8 | ConvertFrom-Json
+    Write-Result OK "config.json konnte gelesen und geparst werden."
+}
+catch {
+    Write-Result FAIL "config.json ist ungültig: $($_.Exception.Message)"
+    exit 2
+}
+
+$requiredConfig = @(
+    "Smtp.ListenAddress",
+    "Smtp.Port",
+    "Graph.TenantId",
+    "Graph.ClientId",
+    "Graph.CertificateThumbprint",
+    "Graph.SenderMailbox",
+    "Paths.Queue",
+    "Paths.Failed",
+    "Paths.Logs"
+)
+
+$configMissing = $false
+
+foreach ($item in $requiredConfig) {
+    $parts = $item -split '\.'
+    $value = $config
+
+    foreach ($part in $parts) {
+        if ($null -eq $value -or -not ($value.PSObject.Properties.Name -contains $part)) {
+            $value = $null
+            break
+        }
+
+        $value = $value.$part
+    }
+
+    if ($null -eq $value -or ([string]$value).Trim().Length -eq 0) {
+        Write-Result FAIL "Config-Wert fehlt: $item"
+        $configMissing = $true
+    }
+}
+
+if (-not $configMissing) {
+    Write-Result OK "Alle erforderlichen Config-Werte sind vorhanden."
+}
+
+# ---------------------------------------------------------------------------
+# SMTP-AUTH Config
+# ---------------------------------------------------------------------------
+$authRequired = $false
+$authUsers = @()
+
+if ($config.Smtp.PSObject.Properties.Name -contains "RequireAuth") {
+    $authRequired = [bool]$config.Smtp.RequireAuth
+}
+
+if ($config.Smtp.PSObject.Properties.Name -contains "AuthUsers") {
+    $authUsers = @($config.Smtp.AuthUsers)
+}
+
+if ($authRequired -and $authUsers.Count -eq 0) {
+    Write-Result FAIL "SMTP-AUTH ist erforderlich, aber es sind keine AuthUsers konfiguriert."
+}
+elseif ($authRequired) {
+    Write-Result OK "SMTP-AUTH ist erforderlich; $($authUsers.Count) Benutzer konfiguriert."
+}
+elseif ($authUsers.Count -gt 0) {
+    Write-Result OK "SMTP-AUTH ist optional; $($authUsers.Count) Benutzer konfiguriert."
+}
+else {
+    Write-Result INFO "SMTP-AUTH ist nicht erforderlich und es sind keine Benutzer konfiguriert."
+}
+
+foreach ($authUser in $authUsers) {
+    $valid = $true
+
+    if ([string]::IsNullOrWhiteSpace([string]$authUser.Username)) { $valid = $false }
+    if ([string]::IsNullOrWhiteSpace([string]$authUser.Salt)) { $valid = $false }
+    if ([string]::IsNullOrWhiteSpace([string]$authUser.PasswordHash)) { $valid = $false }
+
+    try {
+        if ([int]$authUser.Iterations -lt 10000) { $valid = $false }
+        [void][Convert]::FromBase64String([string]$authUser.Salt)
+        [void][Convert]::FromBase64String([string]$authUser.PasswordHash)
+    }
+    catch {
+        $valid = $false
+    }
+
+    if (-not $valid) {
+        Write-Result FAIL "SMTP-AUTH Benutzer '$($authUser.Username)' besitzt ungültige Hash-/Salt-Daten."
+    }
+}
+
+# ---------------------------------------------------------------------------
+# Module
+# ---------------------------------------------------------------------------
+$graphModule = Get-Module -ListAvailable -Name Microsoft.Graph.Authentication |
+    Sort-Object Version -Descending |
+    Select-Object -First 1
+
+if ($graphModule) {
+    Write-Result OK "Microsoft.Graph.Authentication $($graphModule.Version) gefunden: $($graphModule.ModuleBase)"
+}
+else {
+    Write-Result FAIL "Microsoft.Graph.Authentication ist nicht installiert."
+}
+
+# ---------------------------------------------------------------------------
+# Zertifikat
+# ---------------------------------------------------------------------------
+$cert = $null
+$certPath = "Cert:\LocalMachine\My\$($config.Graph.CertificateThumbprint)"
+
+try {
+    $cert = Get-Item -LiteralPath $certPath -ErrorAction Stop
+    Write-Result OK "Relay-Zertifikat gefunden: $($cert.Thumbprint)"
+
+    if ($cert.HasPrivateKey) {
+        Write-Result OK "Zertifikat besitzt einen privaten Schlüssel."
+    }
+    else {
+        Write-Result FAIL "Zertifikat besitzt keinen privaten Schlüssel."
+    }
+
+    $daysRemaining = [Math]::Floor(($cert.NotAfter.ToUniversalTime() - [DateTime]::UtcNow).TotalDays)
+
+    if ($daysRemaining -lt 0) {
+        Write-Result FAIL "Zertifikat ist abgelaufen seit $($cert.NotAfter)."
+    }
+    elseif ($daysRemaining -le 14) {
+        Write-Result FAIL "Zertifikat läuft in $daysRemaining Tagen ab ($($cert.NotAfter))."
+    }
+    elseif ($daysRemaining -le 60) {
+        Write-Result WARN "Zertifikat läuft in $daysRemaining Tagen ab ($($cert.NotAfter))."
+    }
+    else {
+        Write-Result OK "Zertifikat gültig bis $($cert.NotAfter) ($daysRemaining Tage verbleibend)."
+    }
+}
+catch {
+    Write-Result FAIL "Relay-Zertifikat nicht gefunden oder nicht lesbar: $($_.Exception.Message)"
+}
+
+# ---------------------------------------------------------------------------
+# Pfade / Queue
+# ---------------------------------------------------------------------------
+$queueRoot = Resolve-ConfigPath $config.Paths.Queue
+$failedDir = Resolve-ConfigPath $config.Paths.Failed
+$logsDir = Resolve-ConfigPath $config.Paths.Logs
+
+$queueIncoming = Join-Path $queueRoot "incoming"
+$queuePending = Join-Path $queueRoot "pending"
+$queueProcessing = Join-Path $queueRoot "processing"
+
+foreach ($entry in @(
+    @{ Name = "Queue Root"; Path = $queueRoot },
+    @{ Name = "Queue incoming"; Path = $queueIncoming },
+    @{ Name = "Queue pending"; Path = $queuePending },
+    @{ Name = "Queue processing"; Path = $queueProcessing },
+    @{ Name = "Failed"; Path = $failedDir },
+    @{ Name = "Logs"; Path = $logsDir }
+)) {
+    if (Test-Path -LiteralPath $entry.Path) {
+        if (Test-DirectoryWritable -Path $entry.Path) {
+            Write-Result OK "$($entry.Name) vorhanden und beschreibbar: $($entry.Path)"
+        }
+        else {
+            Write-Result FAIL "$($entry.Name) vorhanden, aber nicht beschreibbar: $($entry.Path)"
+        }
+    }
+    else {
+        Write-Result WARN "$($entry.Name) fehlt: $($entry.Path)"
+    }
+}
+
+$pendingFiles = @()
+$processingFiles = @()
+$failedFiles = @()
+
+if (Test-Path -LiteralPath $queuePending) {
+    $pendingFiles = @(Get-ChildItem -LiteralPath $queuePending -Filter "*.eml" -File -ErrorAction SilentlyContinue)
+}
+
+if (Test-Path -LiteralPath $queueProcessing) {
+    $processingFiles = @(Get-ChildItem -LiteralPath $queueProcessing -Filter "*.eml" -File -ErrorAction SilentlyContinue)
+}
+
+if (Test-Path -LiteralPath $failedDir) {
+    $failedFiles = @(Get-ChildItem -LiteralPath $failedDir -Filter "*.eml" -File -ErrorAction SilentlyContinue)
+}
+
+if ($pendingFiles.Count -eq 0) {
+    Write-Result OK "Pending Queue ist leer."
+}
+else {
+    $oldestPending = $pendingFiles | Sort-Object LastWriteTime | Select-Object -First 1
+    $ageMinutes = [Math]::Floor(((Get-Date) - $oldestPending.LastWriteTime).TotalMinutes)
+
+    if ($ageMinutes -ge $QueueWarningAgeMinutes) {
+        Write-Result WARN "$($pendingFiles.Count) Mail(s) in pending; älteste ist $ageMinutes Minuten alt."
+    }
+    else {
+        Write-Result INFO "$($pendingFiles.Count) Mail(s) in pending; älteste ist $ageMinutes Minuten alt."
+    }
+}
+
+if ($processingFiles.Count -gt 0) {
+    Write-Result WARN "$($processingFiles.Count) Mail(s) liegen aktuell in processing."
+}
+else {
+    Write-Result OK "Processing Queue ist leer."
+}
+
+if ($failedFiles.Count -ge $FailedWarningCount) {
+    Write-Result WARN "$($failedFiles.Count) Mail(s) liegen in failed."
+}
+else {
+    Write-Result OK "Failed Queue enthält $($failedFiles.Count) Mail(s)."
+}
+
+# ---------------------------------------------------------------------------
+# Scheduled Task
+# ---------------------------------------------------------------------------
+$task = Get-ScheduledTask -TaskName "SMTPGraphRelay" -ErrorAction SilentlyContinue
+
+if ($task) {
+    Write-Result OK "Scheduled Task 'SMTPGraphRelay' vorhanden."
+
+    $taskInfo = Get-ScheduledTaskInfo -TaskName "SMTPGraphRelay"
+
+    if ($task.State -eq "Running") {
+        Write-Result OK "Scheduled Task läuft."
+    }
+    else {
+        Write-Result WARN "Scheduled Task State: $($task.State)"
+    }
+
+    if ($taskInfo.LastTaskResult -eq 0 -or $taskInfo.LastTaskResult -eq 267009) {
+        Write-Result OK "LastTaskResult: $($taskInfo.LastTaskResult)"
+    }
+    else {
+        Write-Result WARN "LastTaskResult: $($taskInfo.LastTaskResult)"
+    }
+
+    $action = $task.Actions | Select-Object -First 1
+
+    if ($action.Execute -match 'WindowsPowerShell\\v1\.0\\powershell\.exe$') {
+        Write-Result OK "Scheduled Task verwendet Windows PowerShell 5.1."
+    }
+    else {
+        Write-Result WARN "Scheduled Task verwendet unerwartetes PowerShell-Binary: $($action.Execute)"
+    }
+}
+else {
+    Write-Result FAIL "Scheduled Task 'SMTPGraphRelay' wurde nicht gefunden."
+}
+
+# ---------------------------------------------------------------------------
+# SMTP Listener
+# ---------------------------------------------------------------------------
+$listenPort = [int]$config.Smtp.Port
+
+try {
+    $listeners = @(Get-NetTCPConnection -LocalPort $listenPort -State Listen -ErrorAction Stop)
+
+    if ($listeners.Count -gt 0) {
+        $owners = @($listeners | Select-Object -ExpandProperty OwningProcess -Unique)
+        Write-Result OK "SMTP Listener aktiv auf TCP $listenPort (PID: $($owners -join ', '))."
+    }
+    else {
+        Write-Result FAIL "Kein Listener auf TCP $listenPort."
+    }
+}
+catch {
+    # Fallback falls Get-NetTCPConnection nicht verfügbar / eingeschränkt.
+    try {
+        $tcp = New-Object System.Net.Sockets.TcpClient
+        $result = $tcp.BeginConnect("127.0.0.1", $listenPort, $null, $null)
+
+        if ($result.AsyncWaitHandle.WaitOne(2000)) {
+            $tcp.EndConnect($result)
+            Write-Result OK "SMTP Listener auf 127.0.0.1:$listenPort erreichbar."
+        }
+        else {
+            Write-Result FAIL "SMTP Listener auf 127.0.0.1:$listenPort nicht erreichbar."
+        }
+
+        $tcp.Close()
+    }
+    catch {
+        Write-Result FAIL "SMTP Listener auf TCP $listenPort nicht erreichbar."
+    }
+}
+
+# ---------------------------------------------------------------------------
+# Graph App-only Auth
+# ---------------------------------------------------------------------------
+if ($graphModule -and $cert -and $cert.HasPrivateKey) {
+    try {
+        Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
+
+        Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
+
+        Connect-MgGraph `
+            -TenantId $config.Graph.TenantId `
+            -ClientId $config.Graph.ClientId `
+            -Certificate $cert `
+            -NoWelcome | Out-Null
+
+        $ctx = Get-MgContext
+
+        if ($ctx -and
+            $ctx.AuthType -eq "AppOnly" -and
+            $ctx.ClientId -eq $config.Graph.ClientId -and
+            $ctx.TenantId -eq $config.Graph.TenantId) {
+
+            Write-Result OK "Microsoft Graph App-only Anmeldung erfolgreich."
+        }
+        else {
+            Write-Result FAIL "Graph-Verbindung vorhanden, aber Kontext entspricht nicht der Relay-App."
+        }
+    }
+    catch {
+        Write-Result FAIL "Microsoft Graph App-only Anmeldung fehlgeschlagen: $($_.Exception.Message)"
+    }
+    finally {
+        Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
+    }
+}
+else {
+    Write-Result WARN "Graph App-only Test übersprungen, da Modul/Zertifikat/Private Key nicht vollständig verfügbar sind."
+}
+
+# ---------------------------------------------------------------------------
+# Optionale echte SMTP-Testmail
+# ---------------------------------------------------------------------------
+if ($SendTestMail) {
+    if ([string]::IsNullOrWhiteSpace($TestRecipient)) {
+        Write-Result FAIL "-SendTestMail wurde angegeben, aber -TestRecipient fehlt."
+    }
+    else {
+        try {
+            $testFrom = [string]$config.Graph.SenderMailbox
+            $smtpAuthPassword = $null
+
+            if ($authRequired -and [string]::IsNullOrWhiteSpace($SmtpUsername)) {
+                $SmtpUsername = Read-Host "SMTP-Benutzer für Health-Check-Testmail"
+            }
+
+            if (-not [string]::IsNullOrWhiteSpace($SmtpUsername)) {
+                $secureSmtpPassword = Read-Host "SMTP-Passwort für '$SmtpUsername'" -AsSecureString
+                $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureSmtpPassword)
+
+                try {
+                    $smtpAuthPassword = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)
+                }
+                finally {
+                    [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)
+                }
+            }
+
+            Write-Result INFO "Sende SMTP-Testmail über 127.0.0.1:$listenPort an $TestRecipient ..."
+
+            [void](Send-RawSmtpTestMail `
+                -Server "127.0.0.1" `
+                -Port $listenPort `
+                -From $testFrom `
+                -To $TestRecipient `
+                -Username $SmtpUsername `
+                -Password $smtpAuthPassword)
+
+            Write-Result OK "SMTP-Testmail wurde vom Relay mit 250 Queued angenommen."
+            Write-Result INFO "Die endgültige Graph-/M365-Zustellung bitte im Relay-Log bzw. Empfängerpostfach prüfen."
+        }
+        catch {
+            Write-Result FAIL "SMTP-Testmail fehlgeschlagen: $($_.Exception.Message)"
+        }
+        finally {
+            $smtpAuthPassword = $null
+        }
+    }
+}
+
+# ---------------------------------------------------------------------------
+# Zusammenfassung
+# ---------------------------------------------------------------------------
+Write-Host ""
+Write-Host "==========================================================" -ForegroundColor Cyan
+Write-Host " Ergebnis" -ForegroundColor Cyan
+Write-Host "==========================================================" -ForegroundColor Cyan
+Write-Host ""
+
+Write-Host (" OK:   {0}" -f $script:OkCount) -ForegroundColor Green
+Write-Host (" WARN: {0}" -f $script:WarnCount) -ForegroundColor Yellow
+Write-Host (" FAIL: {0}" -f $script:FailCount) -ForegroundColor Red
+Write-Host ""
+
+if ($script:FailCount -gt 0) {
+    Write-Host "Gesamtstatus: FEHLER" -ForegroundColor Red
+    exit 2
+}
+elseif ($script:WarnCount -gt 0) {
+    Write-Host "Gesamtstatus: WARNUNG" -ForegroundColor Yellow
+    exit 1
+}
+else {
+    Write-Host "Gesamtstatus: OK" -ForegroundColor Green
+    exit 0
+}