diff --git a/backend/config/manager_v2_test.go b/backend/config/manager_v2_test.go
index cf23f74..c25653b 100644
--- a/backend/config/manager_v2_test.go
+++ b/backend/config/manager_v2_test.go
@@ -439,6 +439,7 @@ func TestConfigManagerMailSectionAppliesBothPartitionsWithoutMailFile(t *testing
 		t.Fatal(err)
 	}
 	runtime.SMTP.Relay = SMTPConfig{
+		RelayEnabled:        true,
 		RelayHost:           "smtp.example.com",
 		RelayPort:           587,
 		Username:            "relay-user",
@@ -1046,11 +1047,12 @@ func TestConfigManagerSecretClearRequiresExplicitConfirmation(t *testing.T) {
 	root := t.TempDir()
 	runtime := validRuntimeConfig()
 	runtime.SMTP.Relay = SMTPConfig{
-		RelayHost:  "smtp.example.com",
-		RelayPort:  587,
-		Security:   "starttls",
-		From:       "no-reply@example.com",
-		FromDomain: "example.com",
+		RelayEnabled: true,
+		RelayHost:    "smtp.example.com",
+		RelayPort:    587,
+		Security:     "starttls",
+		From:         "no-reply@example.com",
+		FromDomain:   "example.com",
 	}
 	writeRuntimeFixture(t, root, runtime)
 	options := ConfigLoaderOptions{Validation: RuntimeValidationOptions{HasSuperAdmin: true, Production: true}}
diff --git a/backend/config/runtime_access_test.go b/backend/config/runtime_access_test.go
index 402f921..875e325 100644
--- a/backend/config/runtime_access_test.go
+++ b/backend/config/runtime_access_test.go
@@ -258,6 +258,7 @@ func TestCurrentSMTPRuntimeSettingsReadsPartitionSnapshot(t *testing.T) {
 
 	runtime := validRuntimeConfig()
 	runtime.SMTP.Relay = SMTPConfig{
+		RelayEnabled:        true,
 		RelayHost:           "smtp.example.com",
 		RelayPort:           587,
 		Security:            "starttls",
@@ -300,6 +301,7 @@ func TestCurrentSMTPRuntimeSettingsOpensPartitionPassword(t *testing.T) {
 	}
 	runtime := validRuntimeConfig()
 	runtime.SMTP.Relay = SMTPConfig{
+		RelayEnabled:        true,
 		RelayHost:           "smtp.example.com",
 		RelayPort:           465,
 		Username:            "relay-user",
@@ -350,7 +352,7 @@ func TestCurrentSMTPRuntimeSettingsFallsBackToLegacyConfig(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got.Password != "relay-password" || got.Relay.Username != "relay-user" || got.Relay.From != "no-reply@example.com" {
+	if got.Password != "relay-password" || got.Relay.RelayEnabled || got.Relay.Username != "relay-user" || got.Relay.From != "no-reply@example.com" {
 		t.Fatalf("legacy SMTP settings = %+v, password=%q", got.Relay, got.Password)
 	}
 }
diff --git a/backend/config/validator.go b/backend/config/validator.go
index 2f9171f..6fe6aa7 100644
--- a/backend/config/validator.go
+++ b/backend/config/validator.go
@@ -168,10 +168,6 @@ func validateSMTP(smtp SMTPConfig) error {
 	return nil
 }
 
-func smtpRelayFieldsConfigured(smtp SMTPConfig) bool {
-	return smtp.RelayHost != "" || smtp.Username != "" || smtp.Password.Configured() || smtp.From != ""
-}
-
 func smtpRelayConfigured(smtp SMTPConfig) bool {
 	return smtp.RelayEnabled
 }
diff --git a/backend/config/validator_security_test.go b/backend/config/validator_security_test.go
index 2eb769a..e487291 100644
--- a/backend/config/validator_security_test.go
+++ b/backend/config/validator_security_test.go
@@ -195,21 +195,23 @@ func TestValidateSMTPKeepsLoginVerificationIndependentFromRelay(t *testing.T) {
 		{
 			name: "partially configured relay",
 			smtp: SMTPConfig{
-				RelayHost:   "smtp.example.com",
-				RelayPort:   587,
-				Security:    "starttls",
-				LoginPolicy: "new_device",
+				RelayEnabled: true,
+				RelayHost:    "smtp.example.com",
+				RelayPort:    587,
+				Security:     "starttls",
+				LoginPolicy:  "new_device",
 			},
 		},
 		{
 			name: "complete relay",
 			smtp: SMTPConfig{
-				RelayHost:   "smtp.example.com",
-				RelayPort:   587,
-				Security:    "starttls",
-				From:        "no-reply@example.com",
-				FromDomain:  "example.com",
-				LoginPolicy: "new_device",
+				RelayEnabled: true,
+				RelayHost:    "smtp.example.com",
+				RelayPort:    587,
+				Security:     "starttls",
+				From:         "no-reply@example.com",
+				FromDomain:   "example.com",
+				LoginPolicy:  "new_device",
 			},
 			valid: true,
 		},
diff --git a/backend/res_init/verification_delivery_test.go b/backend/res_init/verification_delivery_test.go
index afc1001..229ac08 100644
--- a/backend/res_init/verification_delivery_test.go
+++ b/backend/res_init/verification_delivery_test.go
@@ -43,7 +43,7 @@ func TestVerificationDeliveryDoesNotHidePartialRelayConfiguration(t *testing.T)
 	projectCalled := false
 	delivery := newVerificationDeliveryWithDependencies(
 		func() (config.SMTPRuntimeSettings, error) {
-			return config.SMTPRuntimeSettings{Relay: config.SMTPConfig{RelayHost: "smtp.example.com"}}, nil
+			return config.SMTPRuntimeSettings{Relay: config.SMTPConfig{RelayEnabled: true, RelayHost: "smtp.example.com"}}, nil
 		},
 		func(config.SMTPRuntimeSettings, verification.Challenge, string) error { return expected },
 		func(verification.Challenge, string) error {