Definition
SMTP authentication is a protocol mechanism that requires a sender to prove their identity — typically with a username and password — before the mail server accepts and relays the message. Modern email sending almost universally requires authentication, whether you are sending through an ESP or directly from an application.
There are several authentication methods. PLAIN and LOGIN transmit credentials in plain text and are only safe over TLS-encrypted connections. CRAM-MD5 and DIGEST-MD5 use challenge-response mechanisms. OAuth 2.0, increasingly adopted by Gmail and Microsoft, replaces static passwords with token-based access for stronger security.
Why SMTP Authentication Matters
Without authentication, a mail server becomes an open relay — a configuration aggressively exploited by spammers and universally blocklisted by other mail servers. Authenticated sending contributes to the reputation of your sending domain and IP address, making it a non-negotiable requirement for inbox placement.
Best Practices
- Always use SMTP authentication, even for internal transactional emails
- Favour OAuth 2.0 over static passwords where supported
- Ensure authentication credentials are rotated regularly and stored securely
- Verify that your SMTP connection uses TLS to protect credentials in transit
Related Glossary Terms
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC Alignment
DMARC identifier alignment determines whether the domain in the From header matches the domains used in SPF and DKIM authentication. Strict or relaxed.
DMARC Policy Tags
DMARC DNS record tags including v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf, and ri control authentication policy, reporting, and alignment enforcement.
DMARC (Domain-based Message Authentication)
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM to prevent domain spoofing and provide reporting on authentication failures.
Acceptance Rate
Acceptance rate is the percentage of emails submitted for delivery that are accepted by the recipient's mail server, representing the first deliverability checkpoint before inbox placement is determined.