Some progress...
Turns out that some of our issues were being caused by ports 993, 995, and 465 being blocked by our external firewall and/or Windows Firewall. So setting the <SSL>on</SSL> property for various protocols was causing issues because those ports were blocked.
But in addition to that, the autodiscover settings within SmarterMail for the various protocols were not using the SSL ports anyway. The IMAP was using port 143 with SSL "on" and POP was using 110 also with SSL "on". We've updated both of those within SmarterMail to 993 and 995, respectively.
For SMTP I think that the recommended best practice these days is to use TLS on port 587 rather than SSL on 465 (somebody please correct me if I'm wrong). However, SmarterMail's auto-generated autodiscover.xml file doesn't set TLS anywhere - just <SSL> as either "on" or "off". There's a property available called <Encryption>TSL</Encryption> and that seems to do the trick.
For now, and because we can, we've decided to produce our own autodiscover.xml files at the root of each of the websites we host (that's the advantage we have in hosting our own custom-build CMS for our customer's websites as well as their hosted email).
We've written a custom HTTP Module in our asp.net application to handle URL rewriting and added detection for the following URLs:
/autodiscover/autodiscover.xml
/.well-known/autoconfig/mail/config-v1.1.xml
Upon detection of those incoming URL requests, we've written some custom code to spit out XML files. If the request is an HTTP GET request then we assume it's some sort of guess-smart system (like Thunderbird) and it'll return the config-v1.1.xml file; if it's a POST then we pretty much assume (for now) that it's an Autodiscover request and return an autodiscover.xml file.
While doing that, if we can determine the specific email address being requested, we also query the old SmarterMail web services to 1) verify that we are hosting the domain, 2) verify that the user exists, and 3) determine whether the user is EAS or not.
Assuming the domain & user exists, then depending on whether it's an EAS user or not we serve up two different autodiscover.xml responses.
EAS:
<?xml version="1.0" encoding="utf-8"?>
<Autodiscover xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/mobilesync/responseschema/2006">
<Culture>en:us</Culture>
<User>
<DisplayName><%= display_name %></DisplayName>
<EMailAddress><%= email_address %></EMailAddress>
</User>
<Action>
<Settings>
<Server>
<Type>MobileSync</Type>
<Url>https://mail.mbsportsweb.ca/Microsoft-Server-ActiveSync</Url>
<Name>https://mail.mbsportsweb.ca/Microsoft-Server-ActiveSync</Name>
</Server>
</Settings>
</Action>
</Response>
</Autodiscover>
Non-EAS:
<?xml version="1.0" encoding="UTF-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
<User>
<DisplayName><%= display_name %></DisplayName>
<EMailAddress><%= email_address %></EMailAddress>
</User>
<Account>
<AccountType>email</AccountType>
<Action>settings</Action>
<Protocol>
<Type>EXPR</Type>
<Server>mail.mbsportsweb.ca</Server>
<ASUrl>https://mail.mbsportsweb.ca/ews/exchange.asmx</ASUrl>
<EwsUrl>https://mail.mbsportsweb.ca/ews/exchange.asmx</EwsUrl>
<OOFUrl>https://mail.mbsportsweb.ca/ews/exchange.asmx</OOFUrl>
<LoginName><%= email_address %></LoginName>
</Protocol>
<Protocol>
<Type>IMAP</Type>
<Server>mail.mbsportsweb.ca</Server>
<Port>993</Port>
<SPA>off</SPA>
<SSL>on</SSL>
<AuthRequired>on</AuthRequired>
<LoginName><%= email_address %></LoginName>
</Protocol>
<Protocol>
<Type>POP3</Type>
<Server>mail.mbsportsweb.ca</Server>
<Port>995</Port>
<SPA>off</SPA>
<SSL>on</SSL>
<AuthRequired>on</AuthRequired>
<LoginName><%= email_address %></LoginName>
</Protocol>
<Protocol>
<Type>SMTP</Type>
<Server>mail.mbsportsweb.ca</Server>
<Port>587</Port>
<SPA>off</SPA>
<SSL>off</SSL>
<Encryption>TLS</Encryption>
<AuthRequired>on</AuthRequired>
<LoginName><%= email_address %></LoginName>
</Protocol>
</Account>
</Response>
</Autodiscover>
Here's the format for the Guess Smart return file:
<?xml version="1.0"?>
<clientConfig version="1.1">
<emailProvider id="mail.mbsportsweb.ca">
<domain>%EMAILDOMAIN%</domain>
<displayName>MBSportsWeb Hosted Email</displayName>
<displayShortName>MBSportsWeb</displayShortName>
<incomingServer type="imap">
<hostname>mail.mbsportsweb.ca</hostname>
<port>993</port>
<socketType>SSL</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</incomingServer>
<incomingServer type="pop3">
<hostname>mail.mbsportsweb.ca</hostname>
<port>995</port>
<socketType>SSL</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</incomingServer>
<outgoingServer type="smtp">
<hostname>mail.mbsportsweb.ca</hostname>
<port>587</port>
<socketType>STARTTLS</socketType>
<username>%EMAILADDRESS%</username>
<authentication>password-cleartext</authentication>
</outgoingServer>
</emailProvider>
</clientConfig>
So far we've tested account creation in Outlook 2013 for both an EAS and a non-EAS account and both worked flawlessly. We've also tested account creation in Thunderbird and for both accounts it created them as IMAP but I think that's because Thunderbird doesn't support EAS accounts.
So now we're on to the next thing, which is trying to get any of this to work on iOS (so far no luck) and Android (no luck there either). We'll also be testing Outlook for iOS and Outlook for Android to see if those work better than the native email apps from either OS. Android is new to me and from what I've heard almost nobody uses the built-in email app because either the Gmail or Outlook ones are much better.
As a side-note, I'm not a big fan of producing our own autodiscover.xml file since I believe this is something that should come out of SmarterMail. But again, since we host both the website and email for our customers, we can get a little creative given that Outlook's first check is to the root domain (aka the website). We'll hopefully end up doing the autodiscover-redirect method (assuming it works on Android) as long as the xml file returned by SmarterMail can start enabling TLS.
One final note for now is that this is way too complicated and there's significant room for improvement in how all this stuff is configured & managed.