IIS SMTP Server

Question

I am trying to set up an SMTP server on a virtual private server. I have typically hosted applications with hosting companies in the past.

I am using SMTP on a website to send mail but need to configure IIS's SMTP Server to allow me to send the mail. I have a couple of questions around this:

1. What settings do I need to set to enable me to hit mail.myDomain.com and provide a user name and password for the mail to send?
2. What security issues do I need to be aware of and how do I lock down the SMTP server?

<monorail
  useWindsorIntegration="true"
  checkClientIsConnected="true"
  smtpHost="mail.myDomain.com"
  smtpUsername="myUsername" smtpPassword="XXX"
>

Answer 1

Under the properties for SMTP Server in IIS 6.0 Manager, you will need the following:

General Tab:

Set the IP address that mail.myDomain.com resolves to.

Access Tab:

Access Control (Authentication): You can use Basic, or use Integrated Windows Authentication and allow the account associated with your IIS Application Pool (assuming web server is on same computer). Using basic may not be a significant issue assuming the web site and SMTP server are co-hosted. Otherwise you might want to consider TLS Encryption.

Connection Control/Relay Restrictions (Connection and Relay): Here you can specifically allow sending/relaying only from the IP address(es) of your server, preventing sending by third parties.

Delivery Tab

(Advanced): If you are sending to a broad range of users, you will likely need to ensure that your masquerade domain is set. An extra step will be ensuring that the IP address of your SMTP server will show as the masquerade domain on a reverse lookup. Your provider will likely need to help with this. Failure to address this could result in mail being rejected by the receiving server.