Subject: SMTP Authentication - is it mandatory if supported?

From: Paul Smith <[email-masked]>
Date: Fri, 31 Aug 2001 20:41:06 +0100

Am I right in thinking that just because a server supports SMTP 
authentication (ESMTP 'AUTH' keyword) it doesn't have to require it?

i.e. our server can be configured so that some IP addresses require 
authentication and others don't, or so that mail to local users doesn't 
require authentication, but mail to remote users does (to allow incoming 
SMTP mail)

However, we've found that once Microsoft Outlook sees that our server 
supports SMTP authentication it insists that the user enters login details, 
without even trying to send a message first. All other email clients we've 
tested are happy to send authentication information if it's supplied or to 
try without if it isn't supplied.

Which is correct?

Paul				VPOP3 - Internet Email Server/Gateway
[email-masked]			http://www.pscs.co.uk/

---

From: [email-masked]
Date: Fri, 31 Aug 2001 17:11:07 -0700 (PDT)

> authentication (ESMTP 'AUTH' keyword) it doesn't have to require it?

Yes you are.

> require authentication, but mail to remote users does (to allow incoming

This is a very common configuration.

> try without if it isn't supplied.

Well, just because a server views SASL as optional doesn't mean the
client agrees. It is perfectly legitimate to have a client that requires
SMTP authentication.

What makes less sense is to have a client which implements "if SASL is
available its required, if it isn't it is not". This isn't nonstandard,
exactly, but it does lead to suboptimal behavior in quite a few cases.

				Ned

---

From: [email-masked]
Date: Fri, 31 Aug 2001 17:11:07 -0700 (PDT)

Yes you are.

				Ned