SMTP Authentication Protocol

SMTP-AUTH is a security measure for email.

The Simple Mail Transfer Protocol or SMTP is the most widely used electronic mail transfer system in the world. An addition to the SMTP protocol allows for extensions and is known as Extended SMTP (ESMTP). One of these extensions is the SMTP Authentication Protocol, known as SMTP-AUTH.

Function

SMTP-AUTH creates a user authentication step when email is sent. Although the user will already be logged into a mail client program, SMTP-AUTH requires that the client log in to the mail server before it will accept mail for transfer.

Drawbacks

SMTP-AUTH is not a compulsory part of SMTP and some mail servers do not use it. In addition, it does not contain safeguards against "spoofing"-- a technique where a spammer, for example, puts the email address of another user or organization in the "From" field of an email to conceal his own identity or trick an unsuspecting user into believing the email is from a trusted sender.

Features

Features such as notification of authenticity to the receiving server are rarely used because they rely on trust between well-known servers. As there are so many client servers in the world, this trust is almost impossible to establish. SMTP-AUTH does not include any type of identity certification for either the sending user or the sending mail server. Also, no mechanism is available for passing on this recommendation to the email recipient.

References

• Internet Engineering Task Force: Request for Comments 2554
• Fehcom: SMTP Authentication [Tutorial]