SMTP AUTH
The SMTP extension (RFC 4954) through which a client logs in to a server, with a password or a token, before sending mail through it.
What it means
A server that offers SMTP AUTH lists the mechanisms it accepts in its EHLO reply, for example AUTH PLAIN, and the client logs in with the AUTH command. Success is 235 2.7.0; invalid credentials are 535 5.7.8; a server that requires authentication answers mail commands from a client that has not logged in with 530 5.7.0. RFC 4954 requires servers to be configurable so that plaintext password mechanisms are refused unless the session is protected, normally by TLS.
Authentication is what lets a submission server relay a user's mail to any destination without being an open relay. It is used on ports 587 and 465; delivery between servers on port 25 is normally unauthenticated. SMTP AUTH proves who submitted the message to the first server and nothing to the recipient's server, which relies on SPF, DKIM and DMARC.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 4954: SMTP Service Extension for Authenticationrfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes