Hello everyone,
I’d like to share an issue we’re experiencing with SmarterMail that’s starting to impact our day-to-day operations, in the hope that someone in the community might have insights or that it can help move the ongoing support investigation forward.
Issue Summary:
An authenticated user using Outlook can send emails using an address other than their own, even if that address is not an authorized alias.
Example: user@domain.com can send an email as ceo@domain.com, which closely resembles internal spoofing.
The "Require Auth Match" option is enabled but does not seem to prevent this behavior.
Discussions with SmarterTools Support:
We’ve opened tickets with support. While communication has taken place, the suggestions provided so far have not resolved the issue.
One recommendation was to disable the "Allow relay for authenticated users" option (Settings > Protocols > SMTP In), which completely blocks email sending via Outlook — therefore, not a viable solution.
We understand that SmarterMail adheres strictly to the RFC standards, distinguishing the following:
"Mail From" (RFC5321 – used for the SMTP envelope and authentication),
from "From" (RFC5322 – the address displayed to the recipient).
However, this issue only occurs through Outlook, and not when using the webmail interface.
Our Findings:
Even when authenticated, a user can freely change the "From" field in Outlook.
Unlike other platforms, SmarterMail does not enforce that the sender address must be the authenticated user's address or one of their aliases.
While this behavior may be RFC-compliant, it presents a significant risk in a professional environment, where any user could impersonate a CEO or another internal user.
Has anyone else experienced this kind of issue?
Is there any configuration or workaround in SmarterMail that would lock the "From" address to the authenticated identity, or at least reject messages where the sender doesn’t match the authenticated user?
Thanks in advance to anyone who can share insights or solutions.
Best regards,