I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS encryption. This is working, except that through testing, it appears that IIS is not verifying the hostname it connects to in the remote certificate. Because of this, I believe it could be possible for someone to perform a man-in-the-middle attack. (The second SMTP relay is not located in the same datacenter, and is not connecting over a VPN).

Is there anyway to configure IIS virtual SMTP server 6.0 to verify the hostname in the outgoing TLS connection?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.