Or, how to spend five hours sending a single email. I tried to do it the right way, with Microsoft App registration and Oauth and all that (which is astoundingly complicated to configure -- it used to be so simple, but every year it gets more complicated), but in the end Digital Ocean doesn't allow you to send ANY traffic toward port 587, or 25. And Microsoft _requires_ you to use 587. I'm sending completely legit business emails (password reset, simple things). Nada. There's a rumor that DO might allow you to use these ports if you contact support but I haven't tried it.
So I had to find a workaround. I tried a vendor I'd use happily before, but that didn't work either. Then I saw a link to SMTP2GO in a forum discussion, and I tried it.
It worked. The test email did not go to junk. The domain changes were few and simple. The smtp2go engineers are really smart. I've tangled with mail servers wayyyy too much over the years and I know it's not easy for them to make it easy, but they did.
If you're on Digital Ocean and you need to send emails from a domain Microsoft controls (with DNS by Cloudflare, but that's irrelevant because the smtp2go guys made it super easy to automatically make the DNS changes) use smtp2go.
Sadly, you have to turn off TLS. Port 8025 worked for me.
Very clean UI, and it's free for under 1,000 emails a month, which is 990 more than I need.
Hope this helps someone.
And yes, I'm posting this at 4:00 a.m. because I thought I would have email working well before midnight.