Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm used to using IIS6 for administering websites but this is my first time using it as a mail server.

I've got the POP3 service working fine and I can get incoming mail without any problems. What I'm trying to do is use the SMTP server for outgoing mail from my phone but I'm not sure that I'm being very safe here.

The only way to get it to work so far was to turn on Relay for all computers and anonymous access. I'm worried that this means I'm wide open and just anyone could send spam through my SMTP server. It seems to be that I could turn on Basic authentication and turn the Relay back off to just computers that successfully authenticate. My only problem with that is, won't someone be able to sniff my passwords? It says that it will be sent clear text.

The only things I found via googling were how to change the settings but not necessarily what I should be doing.

share|improve this question
up vote 1 down vote accepted

This guide has all you ever needed (or wanted) to know about SMTP in IIS 6. Expand the selections on the left and look at the SMTP Security subject in particular.

share|improve this answer
So the only way I can use it as a authenticated relay is with TLS? – AndyMcKenna Sep 25 '09 at 3:36
No. You don't have to set the option to require TLS. – joeqwerty Sep 26 '09 at 1:19

Basic authentication is not quite cleartext, but it's a very weak encryption that you shouldn't trust an important password to.

I use SMTP on IIS6, but I have the advantage of a static IP address and can limit relaying to that address. I don't think that would be an option for your phone.

The best way to authenticate over windows is NTLM (or Integrated Windows Authentication) but that means you need a Windows client. Might work on a windows mobile phone, but i never tried it.

I'd use Google Apps instead. It's free and easy.

share|improve this answer
I beg to differ as all the IIS SMTP documentation states that Basic Authentication is clear-text. Only when selecting the option to require TLS is it encrypted. – joeqwerty Sep 23 '09 at 17:55
My phone is a MyTouch 3G running Android. I'd like to be able to use this address instead of my gmail account. – AndyMcKenna Sep 23 '09 at 18:04

It depends on what your using the mail server for...

If your just using to to send out email from the server then you can block connections and relaying from other computers.

To do this: In the Access tab, go to Connection Control and set it to : 'Only the List below' and add '' (localhost).

In the Access tab, go to Relay Restrictions and set it to : 'Only the List below' and add '' (localhost).

share|improve this answer
I want to use it to relay mail sent from my phone. – AndyMcKenna Sep 23 '09 at 18:24
I imagine there could also be other people using the SMTP service in the future if I create mail accounts for them. – AndyMcKenna Sep 23 '09 at 18:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.