• "Require Auth Match= EmailAddress "
• Domain-level restrictions
• Mandatory SMTP authentication
• Allow Relay = Nobody

@Douglas Foster
The "Allow relay" option is already set to "Nobody", and the SMTP whitelist does not include the source IP address.

@Sérgio Rocha
You can find below the SMTP log:

@Mark Thornton
In your case, you mentioned sending an email impersonating a user from another domain. In our case, as shown in the log above, a user is either impersonating a user from the same domain or from a different domain that also exists on the same SmarterMail server.

If you sent an email impersonating a user from another domain that exists on the same SmarterMail server, please let us know which version of Outlook you are using.

Hi,

@Douglas Foster

Yes, as mentioned in my initial message, we do have an open ticket with support. However, for reasons that are still unclear to me, we were redirected here by the support team.

Here is what they wrote in their last message:

“I’ve escalated this request by adding it to the product backlog…

In the meantime, I do recommend that you utilize the SmarterTools Community to garner support and feedback on this request…

At this time I am going to close out this case…”

So while the case was technically escalated, we were also advised to come here for visibility and community support. That’s the only reason we’ve brought the topic to this forum.

@Mark Thornton, Rod Strumbel

Yes, the version of Outlook being used is 2016, but it’s also possible to reproduce the same behavior using another client that doesn’t perform this check natively — for example, using a CLI tool like swaks. For more recent versions of Outlook, as well as Thunderbird and Apple Mail, this behavior is blocked directly at the client level.

Also, to clarify:

Yes, we are using the latest version of SmarterMail, and this issue occurs across all versions we’ve tested.

And yes, the domains used for testing are all hosted on the same SmarterMail server.

Hi Derek,

Thank you very much for your time and for looking into this issue.

Perhaps I didn’t express myself clearly in the original request, as I’m a French speaker and there may have been some misunderstandings. To clarify:

our goal is to prevent internal spoofing, so that a user can only send emails using their own address or an alias explicitly assigned to them — and nothing else.

We want to ensure that no user can send messages with a "From" address that doesn’t belong to them or hasn’t been authorized.

Once again, I truly appreciate your attention to this matter, and I remain at your disposal to provide any additional information needed to help resolve the behavior we've observed.

Best regards,

Thanks for the clarification, Derek.