SMTP needs no user or password, why?

[Top Hat]

Just curious.

To send an email via SMTP needs no password or user name, this seems wrong, anyone know why that is?

 

[MartBrooks]

It depends on how your mail server is set up.

My mail server will accept any email for my domain from any computer on the Internet. However to use my mail server to send an email to an address that's not in my domain requires the sender (i.e. me) to authenticate with a username and password.

 

[woodss]

ooo open relay, what's the address?

 

[KM-Tiger]

No it's not wrong.

Many ISPs allow sending via their servers as long as the connecting IP address is one of theirs. So in effect you are being authenticated by virtue of the IP address from which you connect. And that is often how you would set up a mailserver on a LAN. You decide to trust the internal IP addresses.

Things get more complicated where users want to send email from anywhere, not just trusted IP addresses, and that's where username/passwd authentication is used.

 

[andygambles]

As well as the above there are some that implement POP/IMAP before SMTP.

So if you have checked your email then you can send email from the same IP for a specified period of time without authenticating.

 

[PureIT]

Can you believe '3' had this problem until recently when they were threatened with being closed down due to the open relay that their dongles provided!

 

[Deleted member 61074]

It could also be authorising using POP before Relay, ie you have to log in and receive email before being able to send.