Subject: RE: SMTP Authentication - is it mandatory if supported?

From: "David Lemson" <[email-masked]>
Date: Fri, 31 Aug 2001 19:51:55 -0700

I am still doing some investigation, but I have heard from some people
in Outlook that as far as they know, Outlook never tries outbound SMTP
auth unless it is configured to do so.  You configure it by checking the
box "My server requires authentication" within the accounts property
sheet.  I would suggest checking to make sure that box is not checked,
if you don't want it to prompt for credentials.

David

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, August 31, 2001 5:11 PM
To: Paul Smith
Cc: [email-masked]
Subject: Re: SMTP Authentication - is it mandatory if supported?

> Am I right in thinking that just because a server supports SMTP 
> authentication (ESMTP 'AUTH' keyword) it doesn't have to require it?

Yes you are.

> i.e. our server can be configured so that some IP addresses require 
> authentication and others don't, or so that mail to local users 
> doesn't require authentication, but mail to remote users does (to 
> allow incoming SMTP mail)

This is a very common configuration.

> However, we've found that once Microsoft Outlook sees that our server 
> supports SMTP authentication it insists that the user enters login 
> details, without even trying to send a message first. All other email 
> clients we've tested are happy to send authentication information if 
> it's supplied or to try without if it isn't supplied.

Well, just because a server views SASL as optional doesn't mean the
client agrees. It is perfectly legitimate to have a client that requires
SMTP authentication.

What makes less sense is to have a client which implements "if SASL is
available its required, if it isn't it is not". This isn't nonstandard,
exactly, but it does lead to suboptimal behavior in quite a few cases.

				Ned