0

I'm used to using IIS6 for administering websites but this is my first time using it as a mail server.

I've got the POP3 service working fine and I can get incoming mail without any problems. What I'm trying to do is use the SMTP server for outgoing mail from my phone but I'm not sure that I'm being very safe here.

The only way to get it to work so far was to turn on Relay for all computers and anonymous access. I'm worried that this means I'm wide open and just anyone could send spam through my SMTP server. It seems to be that I could turn on Basic authentication and turn the Relay back off to just computers that successfully authenticate. My only problem with that is, won't someone be able to sniff my passwords? It says that it will be sent clear text.

The only things I found via googling were how to change the settings but not necessarily what I should be doing.

1

This guide has all you ever needed (or wanted) to know about SMTP in IIS 6. Expand the selections on the left and look at the SMTP Security subject in particular.

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/e4cf06f5-9a36-474b-ba78-3f287a2b88f2.mspx?mfr=true

  • So the only way I can use it as a authenticated relay is with TLS? – AndyMcKenna Sep 25 '09 at 3:36
  • No. You don't have to set the option to require TLS. – joeqwerty Sep 26 '09 at 1:19
0

Basic authentication is not quite cleartext, but it's a very weak encryption that you shouldn't trust an important password to.

I use SMTP on IIS6, but I have the advantage of a static IP address and can limit relaying to that address. I don't think that would be an option for your phone.

The best way to authenticate over windows is NTLM (or Integrated Windows Authentication) but that means you need a Windows client. Might work on a windows mobile phone, but i never tried it.

I'd use Google Apps instead. It's free and easy.

  • I beg to differ as all the IIS SMTP documentation states that Basic Authentication is clear-text. Only when selecting the option to require TLS is it encrypted. – joeqwerty Sep 23 '09 at 17:55
  • My phone is a MyTouch 3G running Android. I'd like to be able to use this address instead of my gmail account. – AndyMcKenna Sep 23 '09 at 18:04
0

It depends on what your using the mail server for...

If your just using to to send out email from the server then you can block connections and relaying from other computers.

To do this: In the Access tab, go to Connection Control and set it to : 'Only the List below' and add '127.0.0.1' (localhost).

In the Access tab, go to Relay Restrictions and set it to : 'Only the List below' and add '127.0.0.1' (localhost).

  • I want to use it to relay mail sent from my phone. – AndyMcKenna Sep 23 '09 at 18:24
  • I imagine there could also be other people using the SMTP service in the future if I create mail accounts for them. – AndyMcKenna Sep 23 '09 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.