Due to PCI-DSS, we are required to disable plaintext authentication. We've achieved this by encapsulating communications between our mail server and clients with TLS on port 465.
The problem lies in that port 25 must remain open and unencrypted for us to receive email from the internet, but should not allow authentication.
I've tried disabling the AUTH command, but that breaks authentication on port 465, too.
Is there a mail server or proxy that will allow separate configuration for port 25 and 465, such that authentication is only available over a secure channel?
Also noteworthy: we are using MailEnable with stunnel in FIPS mode.
MailEnable supplied a patched SMTP executable that allowed me to configure via Windows' registry whether authorization is offered on each listening port. This solved my problem—hopefully, they will publish the patch as a hotfix.