Definition
SMTP Auth, short for SMTP Authentication, is the mechanism by which a mail client proves its identity to a mail server before being allowed to submit and relay messages. It requires the client to present valid credentials — usually a username and password, or a token — which the server verifies before accepting mail for delivery. SMTP Auth is what separates authorised users from open relays that spammers can abuse.
How It Works
SMTP Auth uses the AUTH command, defined in RFC 4954, as part of the SMTP conversation. When a client connects to submit a message, the sequence is:
- The client connects to the submission server, typically on a dedicated port.
- The server advertises the authentication methods it supports.
- The client sends the AUTH command with its credentials, often encoded using a supported mechanism.
- The server verifies the credentials and accepts or rejects the session.
- If accepted, the client may submit messages for relay.
Common authentication mechanisms include PLAIN, LOGIN, and more secure options. Encrypting the connection with TLS is essential, because older mechanisms transmit credentials in a form that would be exposed on an unencrypted connection.
Why It Matters
SMTP Auth protects mail infrastructure from being used to relay spam. An open relay — a server that accepts and forwards mail from anyone — is quickly discovered and abused, landing its IP on email blacklists. Requiring authentication ensures only legitimate, authorised senders can use the server.
SMTP Auth is also a core part of legitimate sending:
- Email clients and applications authenticate before submitting transactional emails and marketing mail.
- Authentication ties sending activity to an accountable account, aiding reputation and abuse handling.
- Providers use authenticated submission as a signal that mail is from a known sender rather than an anonymous source.
SMTP Auth should not be confused with domain-level authentication such as SPF and DKIM. SMTP Auth controls who may use the server; SPF and DKIM authenticate the domain to the receiving server. Both layers are needed.
Example
A developer configures an application to send order notifications through a mail server. The application authenticates using an API key over an encrypted connection before submitting each message. Without that authentication step, the server would refuse the mail, preventing the account from being used as a relay.
Was this useful?
Related Glossary Terms
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
Frequently Asked Questions
SMTP Auth proves to the sending server that the client is allowed to submit mail. DKIM proves to the receiving server that the message genuinely came from the domain that signed it. They operate at different stages of the delivery path.
Authenticated submission typically uses port 587 with STARTTLS, or port 465 for implicit TLS. Port 25 is reserved for server-to-server relay and should not be used for client submission.
Yes, for any legitimate submission through a mail server or ESP. Authenticated submission prevents open relay abuse and ties sending to an accountable account, which supports a healthy sender reputation.
No. Many authentication mechanisms transmit credentials in a recoverable form, so the connection should always be encrypted with TLS. Sending credentials over plain text exposes them to interception.