Security and Authentication

Top  Previous  Next



Enable SMTP Authentication: Specifies whether Alligate should use SMTP authentication with clients that wish to send email to external domains through this server. Alligate supports AUTH PLAIN and AUTH LOGIN authentication methods. It does not support encrypted authentication methods like CRAM-MD5.


Require authentication for all outgoing mail: This option specifies whether all outgoing mail must be authenticated using SMTP authentication. Selecting this option will prevent address spoofing where senders use a local domain in the MAIL FROM command during the SMTP conversation. Care should be given when selecting this option to ensure that web forms and other legacy mail sending mechanisms that do not or can not authenticate will not be blocked.


Enable Secondary AUTH ONLY SMTP Server on Port: This option sets up a separate SMTP server on a different port other than 25 where clients that wish to send email to external domains and are using SMTP authentication can send email.  This is very useful for remote clients that need to send email through their company server, but the location they are currently at blocks outgoing traffic on port 25.


Do not replay AUTH conversation when delivering messages: When disabled, this option specifies that Alligate should authenticate with your local server both when it first accepts a message and also when it actually delivers a message to your local server. Unless your mail server will require all messages coming in from the Alligate mail server to be re-authenticated, it is best to leave this option checked. You can also set your mail server to consider the Alligate server as a "trusted" source.


KillList checking should also be applied to secondary AUTH ONLY SMTP connections: Normally, Alligate will completely ignore all connections coming in on the secondary AUTH ONLY SMTP port. Since a user name and password MUST be used to send email, there is no reason to check these for spam. There are however circumstances where you may wish to block certain addresses. These might include an infected computer that is sending out authenticated spam. To block these, you would enter the sending computers IP address in the User Defined Kill list, and check this box.


Allow Relay For: Specifies IP addresses and ranges that are allowed to relay outgoing email through Alligate without authenticating. Also see Whitelists.


Keep Copies of All Mail: Specifies whether Alligate should store all message passing through it for future review/archiving. Use this option with care as it can quickly consume a considerable amount of disk space.