Using the SMTP submission port About the SMTP submission port Authentication options About the SMTP submission port SMTP submission (port 587) support is a step in the direction of Internet Services supporting Sender Policy Framework (SPF), an SMTP technology for reducing SPAM. Currently, you only need to use this port if you have users on POP or IMAP whose Internet service providers have started blocking port 25. The SMTP submission port separates personal (submission) user messages from server to server messages and requires users to authenticate (log in) to send messages through the submission port. It also makes it possible to treat these messages differently in other ways. For example, you don't need to do reverse lookups on these messages and you can run different mail rules on them and add in missing message IDs. To configure and activate the submission port, fill in the Submission tab on the Advanced Mail form. A future version of IS may implement a separate mail rules document for submitted messages. Currently, you can use the built-in variable IsSubmission in rules.MailRules to check whether a message is coming in on the submission port. Top Authentication options IS supports three different authentication options when submitting mail messages via SMTP (either port 25 or the SMTP submission port 587): LOGIN, PLAIN and CRAM-MD5. LOGIN and PLAIN are unsecure when used over an unencrypted (non-TLS) connection, and so their use should be disabled when an SSL certificate is installed for the SMTP server. The configuration choices are: SMTP authentication disabled No authentication allowed. All authentication methods allowed on any connection The old default. Reasonably secure for clients that choose CRAM-MD5. CRAM-MD5 allowed on any connection, Plain text allowed on TLS connections only The new default. Reasonably secure for non-TLS connections. CRAM-MD5 allowed on any connection, Plain text disabled Reasonably secure. Should be the choice for sites without an SMTP SSL certificate. CRAM-MD5 allowed on TLS connections only, Plain text disabled The most secure. "Reasonably secure" means the password is undetectable until CRAM-MD5 is broken. Top