STMP authentication protects your email program from unauthorized use and possible spam. It's a non-negotiable part of any legitimate email-sending program.
Think about it.
What if anyone could send a message from your account, spoof your brand, and damage your mail infrastructure? And what if we told you that spammers can do all of those things if you don’t properly secure your email program?
Spammers have proven time and again that they’re willing to operate on the path of least resistance, which means account security needs to be at an all-time high on your mail server.
Simple Mail Transfer Protocol (SMTP) remains one of the simplest ways to migrate from an on-premise email server to an email service provider (ESP) and generally is one of the simpler methods of sending an email. (Need a refresher on SMTP? Go here.)
Email as a communication channel is only as good as the security you and your service provider put in place to protect your email program. That’s where SMTP authentication comes in.
SMTP authentication not only allows you to leverage the built-in scalability and features of your SMTP service provider, but it also protects your email program and account from non-permitted use and spam.
We’ll talk through what SMTP authentication is, why it matters, and how Twilio SendGrid has taken measures to keep SMTP relay secure.
SMTP authentication is a method of securing your email sending. It’s when a client logs in using a supported authentication mechanism by the submission server.
By updating existing outbound email configurations, SMTP authentication is a seamless way for senders to redirect traffic to a secure third-party solution.
When it comes to SMTP authentication, one size doesn't fit all. There are several methods you can use to prove you're you—and not some sneaky spammer trying to hijack your email reputation:
PLAIN: The simple sibling PLAIN is the most straightforward authentication method—it sends your username and password in one go. While it's easy to implement, it's like shouting your secrets across a crowded room. Always use it with TLS encryption, or you might as well hand your login details to every cybercriminal in town.
LOGIN: The chatty option LOGIN is similar to PLAIN, but it's a bit more talkative. It sends your username and password in separate steps. It's still not winning any security awards on its own, so make sure you're using it with TLS too.
CRAM-MD5: The cryptographic CRAM-MD5 steps up the security game. It uses a challenge-response mechanism, which means your password never travels across the network in plain text. It's like a secret handshake that changes every time.
OAuth 2.0: The new OAuth 2.0 is the modern, secure way to handle authentication. Instead of sending your password, it uses tokens.Many big players like Gmail use OAuth 2.0, and for good reason—it's more secure and allows for easier account management.
To authenticate for SMTP, you’ll first need to authenticate your domain. Authenticating with your Twilio SendGrid account credentials means “proving who you are” to our outbound mail server.
An SPF allows senders to deploy a domain name system (DNS) record that contains a list of authorized IP addresses that can send emails from a particular domain. A DKIM is a cryptographic signature used to sign a particular email message to ensure the message has come from an authorized source from this domain.
2. SMTP account authentication
When sending a message to Twilio SendGrid’s SMTP relay (smtp.sendgrid.net), authentication is necessary in the form of your account’s API key.
Each account or subuser on Twilio SendGrid has its own set of credentials that we use to determine which environment to send a message from (e.g., marketing subuser vs. transactional subuser or production subuser vs. dev subuser). This granular control allows for clear segmentation between mail streams and environments for your program to ensure there’s no cross-contamination in sending reputations.
For a step-by-step walk-through on how to send an SMTP email with Twilio SendGrid, go to our docs article.
Without authentication, it’s possible for spammers and bad actors to damage your email program with tactics like email spoofing. Email spoofing is a tactic used by bad actors attempting to send mail with a forged sending address that they don't own.
Without authentication, your account is vulnerable to spammers and bad actors.
Additionally, recipient servers may view your mail as untrustworthy. This means you (or worse, someone else) could be sending unauthenticated email messages through your account. If the message is delivered at all, it leads to high filtering rates and spam delivery.
This also means that your account could be exposed to phishing attacks while spoofing your sending domain. Luckily, with Twilio SendGrid’s new security features, you can send mail from an authenticated source and with proof of ownership of the domain from which you sent the mail.
In order to continue to utilize email as a trusted communication channel, Twilio SendGrid is committed to deploying the most secure methods of sending for your email program. Here are a few ways Twilio SendGrid has secured its SMTP service.
Twilio SendGrid fully supports SMTP Secure (SMTPS), a method of SMTP using transport layer security (TLS) as the connection layer. Twilio SendGrid accepts TLS connections on port numbers 25, 587, and 2525. You can also connect via a secure sockets layer (SSL) on port 465.
SMTP Secure is a secure way to send email, but it still needs the SMTP authentication process we discussed above.
As of Q4 of 2020, Twilio SendGrid has enforced two-factor authentication for all accounts. This means rejecting any SMTP requests utilizing a basic authentication (Twilio SendGrid username and password).
Due to this change, all SMTP requests must use an API key to authenticate. This is far more secure than a username and password for your requests, not only because of the length of the alphanumeric string but also because you can restrict API permissions and remove scopes at any time.
Twilio SendGrid’s IP Access Management feature allows you to control access to your Twilio SendGrid account within your network. This feature ensures only you and your team from known specified IP addresses can access the account. For more information on this feature, please see our documentation.
To learn more about Twilio SendGrid’s latest security updates or email best practices, subscribe to our monthly email newsletter, The Scoop.
Some sort of SMTP authentication is better than nothing at all, but there are other best practices you can follow to completely lock down your email program:
Rotate your API keys regularly: Think of your API keys like your toothbrush—change them regularly and don't share them with others. We recommend rotating your keys every 30-90 days.
Implement IP whitelisting: Only pre-approved IP addresses get in. It's an extra layer of security that makes sure only authorized systems can use your SMTP credentials. Just remember to update your whitelist when your IP addresses change, or you might lock yourself out of your own party.
Monitor authentication logs: Keep an eye on your authentication logs. They're the breadcrumbs that can lead you to potential security issues. Look for unusual login patterns or failed authentication attempts.
Use the principle of least privilege: When setting up API keys or user accounts, only grant the permissions necessary for that specific task. It's like giving your house sitter a key that only opens the front door, not one that also opens your safe. If a key gets compromised, the damage is limited.
Enable two-factor authentication (2FA): Even if someone cracks your password, they still need that second factor to get in. At Twilio SendGrid, we require 2FA for all accounts—it's that important.
Keep your SMTP client software updated: Regularly update your email client and any libraries you use for SMTP. These updates often include crucial security patches.
Use secure connections: Always, always, always use TLS encryption when connecting to your SMTP server. Sending credentials over an unencrypted connection is like shouting your password in a crowded coffee shop. Not cool, and definitely not secure.
Regularly audit your email-sending practices: Perform regular audits of your email-sending practices. Who has access to send emails? Are all those users still with the company? Are your authentication methods up to date?
Leveraging a secure SMTP server ensures the protection of your email infrastructure against spam and spoofing attacks. Security, flexibility, and seamless integration are all factors to consider for your next SMTP provider. If you’re ready to choose your SMTP service provider, check out Twilio SendGrid’s SMTP service offerings or sign up for free to test it out.
For more information on SMTP servers and SMTP authentication, check out the following resources:
