hmLoadTopic({
hmKeywords:"AUTH,Authentication,Global,Global Auth,SMTP Authentication",
hmTitle:"SMTP Authentication",
hmDescription:"SMTP Authentication (AUTH) Authentication is always required when mail is from local accounts When this option is enabled and an incoming message claims to be from one of MDaem",
hmPrevLink:"security--ip_shielding.html",
hmNextLink:"security--spf__sender_id.html",
hmParentLink:"security_menu.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Sender Authentication",
hmTitlePath:"Security Menu > Security Manager > Sender Authentication > SMTP Authentication",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">SMTP Authentication<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/sender-authentication_smtp-authentication.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">SMTP Authentication (AUTH)<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Authentication is always required when mail is from local accounts<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is enabled and an incoming message claims to be from one of MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s domains, the account must first be authenticated or MDaemon will refuse to accept the message for delivery. This option is enabled by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...unless message is to a local account<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">If you are requiring authentication when a message is from a local sender, but wish to skip the authentication restriction when the recipient is local as well, then click this option. Note: this may be necessary in some situations where you require some of your users to use different mail servers for outgoing and incoming mail.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...unless Domain Sharing finds the sender on another server<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">By default, when <a href=\"domain-sharing.html\" class=\"topiclink\">Domain Sharing<\/a> finds the sender on another server, that sender will be exempt from the <\/span><span class=\"f_ControlIndent2\" style=\"font-style: italic;\">Authentication is always required...<\/span><span class=\"f_ControlIndent2\"> option above. Clear this checkbox if you wish to require authentication from those senders as well.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Authentication is always required when mail is sent from local IPs<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish to require authentication when an incoming message is being sent from a local IP address. If unauthenticated the message will be rejected. <a href=\"security--trusted_ips.html\" class=\"topiclink\">Trusted IPs<\/a> are exempt, and this option is enabled by default for new installations.<\/span><\/p>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Credentials used must match those of the return-path address<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default, the credentials used during SMTP authentication must match those of the address found in the message\'s return-path. Disable this option if you do not wish to require the return path to match. To support gateway mail storage and forwarding, there is a corresponding option located on the <a href=\"gateway_global.html\" class=\"topiclink\">Global Gateway Settings<\/a> screen that will &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Exempt gateway mail from AUTH credential matching requirements<\/span><span class=\"f_ControlIndent\">&quot; by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Credentials used must match those of the \'From:\' header address<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default, the credentials used during SMTP authentication must match those of the address found in the message\'s &quot;From:&quot; header. Disable this option if you do not wish to require the &quot;From:&quot; header to match. To support gateway mail storage and forwarding, there is a corresponding option located on the <a href=\"gateway_global.html\" class=\"topiclink\">Global Gateway Settings<\/a> screen that will &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Exempt gateway mail from AUTH credential matching requirements<\/span><span class=\"f_ControlIndent\">&quot; by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Exempt list<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use the Credentials Matching Exempt List<\/span><span class=\"f_ControlIndent\"> to exempt an address from the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Credentials used must match...<\/span><span class=\"f_ControlIndent\">&quot; options above. To be exempt from the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">...must match those of the return-path address<\/span><span class=\"f_ControlIndent\">&quot; option, the<\/span><span class=\"f_ControlIndent\"> exempt address must match the address in the message\'s <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">Return-Path<\/span><span class=\"f_ControlIndent\">. To be exempt from the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">...must match those of the \'From:\' header address<\/span><span class=\"f_ControlIndent\">&quot; option, the<\/span><span class=\"f_ControlIndent\"> exempt address must match the address in the message\'s <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">From:<\/span><span class=\"f_ControlIndent\"> header.<\/span><\/p>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Mail from <\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading\">Postmaster<\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading\">, <\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading\">abuse<\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading\">, <\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading\">webmaster<\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading\"> must be authenticated<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this checkbox to require messages claiming to be from one of your &quot;postmaster@...&quot;, &quot;abuse@...&quot; or &quot;webmaster@...&quot; aliases or accounts to be authenticated before MDaemon will accept them. Spammers and hackers know that these addresses might exist, and may therefore attempt to use one of them to send mail through your system. This option will prevent them and other unauthorized users from being able to do so. This option is mirrored on the <a href=\"alias_options.html\" class=\"topiclink\">Settings screen<\/a> of Aliases. Changing the setting here will change it there as well.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Do not apply POP Before SMTP to authenticated sessions<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If you are utilizing the <a href=\"security--pop_before_smtp.html\" class=\"topiclink\">POP Before SMTP<\/a> security feature, you can click this option to make authenticated users exempt from this restriction. An authenticated user will not need to check his or her email before sending messages.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Do not allow authentication on the SMTP port<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This option disables AUTH support over the SMTP port. AUTH will not be offered in the EHLO response, and will be treated as an unknown command if provided by the SMTP client. This setting and the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">...add their IP to the Dynamic Screen<\/span><span class=\"f_ControlIndent\">&quot; option below are useful in configurations where all legitimate accounts are using the MSA or other port to submit authenticated mail. In such configurations the assumption is that any attempt to authenticate on the SMTP port must be from an attacker.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...add their IP to the Dynamic Screen if they attempt it anyway<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">When using the <\/span><span class=\"f_ControlIndent2\" style=\"font-style: italic;\">Do not allow authentication on the SMTP port<\/span><span class=\"f_ControlIndent2\"> option above, this option will add to the Dynamic Screen any IP address of any client that attempts to authenticate on the SMTP port anyway. The connection will also be immediately terminated.<\/span><\/p>\n\r"
})
