Hello,

Not sure if it helps but have you checked if you have SMTP Auth Bypass enabled for 127.0.0.1 in Settings -> Security > Whitelists ?

If yes, try to disable it.

Kind regards

Yes, but no effects on webmail...

Daniele

Have you actually managed to send an email succesfully to an external domain or internal?

I have tried but the recipient is not showing and the mail is not sent.

Hello TD8net; I believe this scenario you outlined should be covered by our authentication settings. In the domain's settings you'll find a toggle to require SMTP authentication, then within Settings>Protocols>SMTP In you'll find similar settings including one called Require Auth Match setting which you can configure for Email Address and that will force the user to authenticate with whichever account they're trying to send from.

No, Kyle. I already have that parameter set as you wrote, but it works only with external clients (eg Thunderbird) and not within the webmail when adding a local smartermail smtp account without enabling authentication.

Thank you anyway for your suggestion.

Daniele

You're very welcome Daniele. When I mimic this test here my outgoing messages are rejected with authentication is required for relay due to my protocol and domain settings requiring authentication during SMTP. It's possible you may have a whitelist entry somewhere that is overriding that requirement perhaps? I recommend we start a ticket to get to the bottom of this.

Hi Daniele, just a quick follow up for you on this. Jorel and I looked at this together and we were able to replicate the behavior only when the SMTP address is an external domain not known to SmarterMail, and I think this is likely why the require auth match and other authentication settings don't get engaged. We're not sure how much of this is expected just yet so we're going to discuss further with our development team and we'll get you an update on this as soon as possible. Thanks Daniele!

Thank you so much! I really appreciate the attention you and Jorel are paying for me.

I've not whitelisted any IP address and all built-in local address are set without SMTP auth bypass:

Here my SMTP in protocol settings:

I've posted in the ticket followed by Jorel (Possible security issue) a YT video where I show you that I was able to spoof email also for an internal domain known to my smartermail server, as well as from an external domain it doesn't know.

Daniele