I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS encryption. This is working, except that through testing, it appears that IIS is not verifying the hostname it connects to in the remote certificate. Because of this, I believe it could be possible for someone to perform a man-in-the-middle attack. (The second SMTP relay is not located in the same datacenter, and is not connecting over a VPN).
Is there anyway to configure IIS virtual SMTP server 6.0 to verify the hostname in the outgoing TLS connection?
Thanks!
