STMP authentication protects your email program from unauthorized use and possible spam. It’s a non-negotiable part of any legitimate email-sending program.
Think about it.
What if anyone could send a message from your account, spoof your brand, and damage your mail infrastructure? And what if we told you that spammers can do all of those things if you don’t properly secure your email program?
Spammers have proven time and again that they’re willing to operate on the path of least resistance, which means account security needs to be at an all-time high on your mail server.
Simple Mail Transfer Protocol (SMTP) remains one of the simplest ways to migrate from an on-premise email server to an email service provider (ESP) and generally is one of the simpler methods of sending an email. (Need a refresher on SMTP? Go here.)
Email as a communication channel is only as good as the security you and your service provider put in place to protect your email program. That’s where SMTP authentication comes in.
SMTP authentication not only allows you to leverage the built-in scalability and features of your SMTP service provider, but it also protects your email program and account from non-permitted use and spam.
We’ll talk through what SMTP authentication is, why it matters, and how Twilio SendGrid has taken measures to keep SMTP relay secure.
What is SMTP authentication?
SMTP authentication is a method of securing your email sending. It’s when a client logs in using a supported authentication mechanism by the submission server.
By updating existing outbound email configurations, SMTP authentication is a seamless way for senders to redirect traffic to a secure third-party solution.
How to use SMTP authentication on your Twilio SendGrid account
1. Domain authentication
To authenticate for SMTP, you’ll first need to authenticate your domain. Authenticating with your Twilio SendGrid account credentials means “proving who you are” to our outbound mail server.
Doing so allows Twilio SendGrid to correlate your send request to your account and deploy configured Sender Policy Framework (SPF) and Domain Key Identified Mail (DKIM) signatures for your sending domain.
An SPF allows senders to deploy a domain name system (DNS) record that contains a list of authorized IP addresses that can send emails from a particular domain. A DKIM is a cryptographic signature used to sign a particular email message to ensure the message has come from an authorized source from this domain.
2. SMTP account authentication
When sending a message to Twilio SendGrid’s SMTP relay (smtp.sendgrid.net), authentication is necessary in the form of your account’s API key.
Each account or subuser on Twilio SendGrid has its own set of credentials that we use to determine which environment to send a message from (e.g., marketing subuser vs. transactional subuser or production subuser vs. dev subuser). This granular control allows for clear segmentation between mail streams and environments for your program to ensure there’s no cross-contamination in sending reputations.
For a step-by-step walk-through on how to send an SMTP email with Twilio SendGrid, go to our docs article.
What happens without SMTP authentication?
Without authentication, it’s possible for spammers and bad actors to damage your email program with tactics like email spoofing. Email spoofing is a tactic used by bad actors attempting to send mail with a forged sending address that they don’t own.
Without authentication, your account is vulnerable to spammers and bad actors.
Additionally, recipient servers may view your mail as untrustworthy. This means you (or worse, someone else) could be sending unauthenticated email messages through your account. If the message is delivered at all, it leads to high filtering rates and spam delivery.
This also means that your account could be exposed to phishing attacks while spoofing your sending domain. Luckily, with Twilio SendGrid’s new security features, you can send mail from an authenticated source and with proof of ownership of the domain from which you sent the mail.
A single sender verification or domain authentication forces users to verify ownership of their sending domain to reduce spoofing across the platform.
How is Twilio SendGrid taking steps to secure SMTP?
In order to continue to utilize email as a trusted communication channel, Twilio SendGrid is committed to deploying the most secure methods of sending for your email program. Here are a few ways Twilio SendGrid has secured its SMTP service.
Secure SMTP
Twilio SendGrid fully supports SMTP Secure (SMTPS), a method of SMTP using transport layer security (TLS) as the connection layer. Twilio SendGrid accepts TLS connections on port numbers 25, 587, and 2525. You can also connect via a secure sockets layer (SSL) on port 465.
SMTP Secure is a secure way to send email, but it still needs the SMTP authentication process we discussed above.
For more on the differences between these ports, please check out our previous discussion.
Two-factor authentication
As of Q4 of 2020, Twilio SendGrid has enforced two-factor authentication for all accounts. This means rejecting any SMTP requests utilizing a basic authentication (Twilio SendGrid username and password).
Due to this change, all SMTP requests must use an API key to authenticate. This is far more secure than a username and password for your requests, not only because of the length of the alphanumeric string but also because you can restrict API permissions and remove scopes at any time.
IP access management
Twilio SendGrid’s IP Access Management feature allows you to control access to your Twilio SendGrid account within your network. This feature ensures only you and your team from known specified IP addresses can access the account. For more information on this feature, please see our documentation.
To learn more about Twilio SendGrid’s latest security updates or email best practices, subscribe to our monthly email newsletter, The Scoop.
Securing your SMTP server
Leveraging a secure SMTP server ensures the protection of your email infrastructure against spam and spoofing attacks. Security, flexibility, and seamless integration are all factors to consider for your next SMTP provider. If you’re ready to choose your SMTP service provider, check out Twilio SendGrid’s SMTP service offerings or sign up for free to test it out.
For more information on SMTP servers and SMTP authentication, check out the following resources: