What is SMTP au­then­ti­ca­tion? SMTP Auth explained

With SMTP au­then­ti­ca­tion, you can increase the security of your SMTP server sig­nif­i­cant­ly. Once you have it set up, only trust­wor­thy users (SMTP clients) will be able to send messages.

What is SMTP au­then­ti­ca­tion?

SMTP au­then­ti­ca­tion, also known as SMTP AUTH or ASMTP, is an extension of the extended SMTP (ESMTP), which, in turn, is an extension of the SMTP network protocol. It allows an SMTP client to log on to an SMTP server using an au­then­ti­ca­tion mechanism. This ensures that only trust­wor­thy users can send and forward emails through the server. In addition, log data can be used to determine who has used the server for SMTP relays.

What is SMTP AUTH used for?

SMTP AUTH prevents an SMTP server from being misused as an open mail relay, through which spam can be spread through­out a network. Although the situation is no longer as critical as it was in the past, it’s still common to find open relay servers that don’t have SMTP au­then­ti­ca­tion set up. Sometimes, this is due to the fact that ad­min­is­tra­tors who lack ex­pe­ri­ence want to test their server and un­der­es­ti­mate the risks as­so­ci­at­ed with tem­porar­i­ly opening it. Often though, the problem results from poorly con­fig­ured firewalls and external security ap­pli­ca­tions.

Open mail relays can usually be iden­ti­fied in a few hours or days, and servers that are iden­ti­fied as such are placed onblock­lists. Once placed on a blocklist, even le­git­i­mate emails can end up in spam folders. This is why it’s important to take SMTP au­then­ti­ca­tion seriously.

For operators of mail servers, having a server that is being used as an open mail relay has multiple con­se­quences. First, it results in higher traffic due to the op­por­tu­ni­ties it provides for spammers. It can also neg­a­tive­ly impact an operator’s rep­u­ta­tion and consume a lot of their time, which, in turn, drives up costs. This is why nearly all mail servers now use ESMTP together with ASMTP (extended SMTP with SMTP au­then­ti­ca­tion).

How does ASMTP work?

An essential feature of ASMTP is that emails are accepted via TCP port 587 (the SMTP AUTH port) and not over the tra­di­tion­al port 25/TCP. This is a mandatory feature of ESMTP. The protocol contains a selection of au­then­ti­ca­tion mech­a­nisms with different levels of security, which, depending on its con­fig­u­ra­tion, an SMTP server can use in order to check the trust­wor­thi­ness of an SMTP client.

These au­then­ti­ca­tion mech­a­nisms include:

• PLAIN: An au­then­ti­ca­tion via the username and password of the client. Both are trans­mit­ted un­en­crypt­ed and then encoded in the Base64 character set.
• LOGIN: This works similarly to PLAIN, but the Base64 character set for the username and password are trans­ferred in two steps rather than just one.
• CRAM-MD5: An al­ter­na­tive to PLAIN and LOGIN with a higher level of security that follows the challenge-response principle. Via this mechanism, the password is not trans­ferred in code or plain text. Instead, the server provides the client with a randomly generated com­pu­ta­tion­al task that can only be solved with the help of the password.
• Other mech­a­nisms include: GSSAPI, DIGEST-MD5, MD5, OAUTH10A, OAU­THE­BEAR­ER, SCRAM-SHA-1, and NTLM.

An example of an SMTP au­then­ti­ca­tion via LOGIN:

How to configure SMTP au­then­ti­ca­tion

In most mail programs, SMTP au­then­ti­ca­tion is con­fig­ured au­to­mat­i­cal­ly when a new account is created. If, for some reason, it isn’t working, you may have to do it manually. Below, you’ll find in­struc­tions on how to set up SMTP au­then­ti­ca­tion for Gmail, Outlook and IONOS Mail.

How to enable SMTP AUTH in Outlook

1. In the File menu, click on Account Settings and then select the option that is also named Account Settings.
2. Choose your account and click on Change.
3. Select More Settings.
4. In the newly opened window, go to Outgoing Server and activate the option My outgoing server (SMTP) requires au­then­ti­ca­tion.
5. Check the box titled Use same settings as my incoming mail server.
6. Confirm it with OK. Now, the window should close.
7. Click on Next for Outlook to check the new account settings and click Close when the test is complete.
8. Now, click on Finish and then Close.

Microsoft 365 users can also activate SMTP au­then­ti­ca­tion in the 365 admin center or using Windows Pow­er­Shell.

How to enable SMTP AUTH in Gmail

When you connect your Gmail address to a desktop client, you can also activate SMTP au­then­ti­ca­tion:

1. Log in to your Gmail account.
2. Click on Settings und select See all settings.
3. Switch to the For­ward­ing and POP/IMAP tab.
4. Here you can click on the Learn more link under either POP download or IMAP access.
5. In both instances, you’ll be directed to setup in­struc­tions, where you can also find relevant in­for­ma­tion about the outgoing mail server (SMTP), including SMTP au­then­ti­ca­tion.

How to enable SMTP AUTH in IONOS Mail

IONOS email plans that use IONOS Webmail come with SMTP AUTH already activated. If you want to set up IONOS Mail in a different desktop client, you can easily configure SMTP au­then­ti­ca­tion manually as well. You can access the relevant settings, including the SMTP AUTH port, in the Control Panel:

1. Log in to your IONOS customer account via the login page.
2. In the product overview, select Email.
3. Next, click on the IONOS mail plan that you want to configure and choose the email address that you want to set up SMTP au­then­ti­ca­tion for.
4. Click on the menu item E-mail server in­for­ma­tion (POP, IMAP).
5. You will now find all the in­for­ma­tion you need to set up the email address, including SMTP au­then­ti­ca­tion.

How do I test SMTP AUTH?

You can use the Telnet client to check whether a mail server is operating as an open relay or to see if SMTP AUTH is func­tion­ing correctly (for example, if you have set up your own mail server). Lots of spammers also use the Telnet client in order to identify open mail relays. SMTP and ESMTP are purely text-based protocols, which is why you can also start and execute a client-server session manually.

You can easily check if your email server has SMTP au­then­ti­ca­tion enabled by using web tools like SMTP Di­ag­nos­tics from MxToolbox:

1. Go to SMTP Di­ag­nos­tic.
2. In the input field, enter the address of the SMTP server or an email address that uses the SMTP server.
3. Click Test Email Server.
4. After a short amount of time, you’ll receive a list of key in­for­ma­tion, including details about SMTP au­then­ti­ca­tion. In the row, where it says SMTP Open Relay, you can see whether au­then­ti­ca­tion is enabled.