ESMTP vs ESMTPA — the difference?

ESMTP: Extended SMTP — supports modern features (8-bit content, PIPELINING, STARTTLS) but no auth required by default; used for server-to-server delivery on port 25. ESMTPA: same + AUTH required — used for client-to-server submission on port 587. ESMTPA = authenticated submission.

Why is port 587 the standard for ESMTPA?

RFC 6409 designates 587 as the submission port (separate from server-to-server 25). Why: lets ISPs/firewalls block outbound 25 to fight spam without blocking legitimate user submission on 587. Modern best practice: clients submit on 587 with STARTTLS + auth; servers exchange on 25.

SASL authentication mechanisms — which?

PLAIN and LOGIN — over TLS only (otherwise credentials in plaintext). CRAM-MD5 — older, less common. OAUTHBEARER — modern OAuth-based, used by Gmail/Workspace. Server config decides which it offers; clients pick first compatible. PLAIN over STARTTLS is the universal fallback.

How do I verify ESMTPA is working?

`openssl s_client -starttls smtp -connect mail.example.com:587 -crlf`. Server should advertise `250-AUTH PLAIN LOGIN` (or similar) in EHLO response. Test auth: `AUTH PLAIN `. Server says `235 Authentication succeeded`. Then MAIL FROM works.

What is ESMTPA?

2 min read

22.04.2026

Key Features of ESMTPA

1. Authentication Requirement:

Unlike basic SMTP, ESMTPA requires the sender to provide valid login credentials (username and password) to authenticate with the mail server.
Prevents unauthorized use of the mail server (e.g., by spammers).

2. Enhanced Security:

Often used in conjunction with secure connections (e.g., SSL/TLS) to encrypt authentication credentials and email content.

3. Used for Outgoing Mail:

Commonly configured for sending emails from email clients like Outlook, Thunderbird, or Apple Mail.

4. Supports Extended SMTP Commands:

ESMTPA is part of ESMTP (Extended SMTP), which includes additional features over standard SMTP, such as:
- EHLO (Extended HELO command for server capabilities).
- Authentication mechanisms like LOGIN, PLAIN, or CRAM-MD5.

How ESMTPA Works

The client connects to the mail server on the appropriate port:
- Common ports:
  - 587 (with STARTTLS for encryption).
  - 465 (for SSL/TLS).
The client sends the EHLO command to initiate an extended SMTP session.
The server responds with a list of supported authentication methods.
The client provides credentials (username and password) using one of the supported methods.
Once authenticated, the server relays the email to the intended recipient.

Configuring ESMTPA in Email Clients

To use ESMTPA for sending emails, you need to configure your email client with the following settings:

What is ESMTPA — ESMTPA — auth-required submission; 587 + STARTTLS standard.

Outgoing Mail Server (SMTP) Settings

Server Address: e.g., smtp.yourdomain.com.
Port:
- 587 (STARTTLS) or 465 (SSL/TLS).
Encryption: Choose SSL/TLS or STARTTLS.
Authentication: Enabled (use your email account's username and password).

Benefits of ESMTPA

Prevents Spam:
- Ensures only authenticated users can send emails, reducing the risk of spam originating from your server.
Supports Encryption:
- Works with SSL/TLS to secure email communication.
Industry Standard:
- Widely supported by email providers and clients.

What is ESMTPA?