Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS encryption. This is working, except that through testing, it appears that IIS is not verifying the hostname it connects to in the remote certificate. Because of this, I believe it could be possible for someone to perform a man-in-the-middle attack. (The second SMTP relay is not located in the same datacenter, and is not connecting over a VPN).

Is there anyway to configure IIS virtual SMTP server 6.0 to verify the hostname in the outgoing TLS connection?


share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.