SMTP authentication

SMTP authentication

STACKIT MailOut accepts AUTH PLAIN for authentication, exclusively via a STARTTLS-encrypted connection on ports 25 and 587 (see RFC 4616). AUTH LOGIN and other legacy mechanisms are not offered since they have not become an official standard.

Connection settings

Replace the placeholders with the values from your created Authorized Sender.

Setting	Value
Hostname	[SMTP endpoint]
Port	25 or 587
Encryption	STARTTLS (required)
Authentication	AUTH PLAIN
Username	[SMTP username]
Password	[SMTP password]

STACKIT MailOut does not support SMTPS on port 465. Please use STARTTLS.

TLS support

STACKIT MailOut uses TLS 1.3 by default for incoming and outgoing SMTP connections. As a fallback, TLS 1.2 is available.

Incoming

The following table contains the supported cipher suites when connecting to the STACKIT MailOut SMTP endpoint:

Protocol	Cipher Suite	Key Exchange	Encryption	Bits	IANA/RFC Name
TLSv1.2	ECDHE-RSA-AES256-GCM-SHA384	ECDH 253	AESGCM	256	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLSv1.2	ECDHE-RSA-CHACHA20-POLY1305	ECDH 253	ChaCha20	256	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLSv1.2	ECDHE-RSA-AES128-GCM-SHA256	ECDH 253	AESGCM	128	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLSv1.3	TLS_AES_256_GCM_SHA384	ECDH/MLKEM	AESGCM	256	TLS_AES_256_GCM_SHA384
TLSv1.3	TLS_CHACHA20_POLY1305_SHA256	ECDH/MLKEM	ChaCha20	256	TLS_CHACHA20_POLY1305_SHA256
TLSv1.3	TLS_AES_128_GCM_SHA256	ECDH/MLKEM	AESGCM	128	TLS_AES_128_GCM_SHA256

For security reasons, STACKIT MailOut does not support TLS versions lower than 1.2.

Outgoing

The following cipher suites are supported for outgoing connections to 3rd party mailbox providers (like Google Gmail, Microsoft Outlook, United Internet, etc. pp.):

Protocol	Cipher Suite	Key Exchange	Encryption	Bits	IANA/RFC Name
TLSv1.3	TLS_AES_256_GCM_SHA384	ECDH/MLKEM	AESGCM	256	TLS_AES_256_GCM_SHA384
TLSv1.3	TLS_AES_128_GCM_SHA256	ECDH/MLKEM	AESGCM	128	TLS_AES_128_GCM_SHA256
TLSv1.3	TLS_CHACHA20_POLY1305_SHA256	ECDH/MLKEM	ChaCha20	256	TLS_CHACHA20_POLY1305_SHA256
TLSv1.2	ECDHE-ECDSA-AES256-GCM-SHA384	ECDH	AESGCM	256	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLSv1.2	ECDHE-ECDSA-AES128-GCM-SHA256	ECDH	AESGCM	128	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLSv1.2	ECDHE-ECDSA-CHACHA20-POLY1305	ECDH	ChaCha20	256	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLSv1.2	ECDHE-RSA-AES256-GCM-SHA384	ECDH	AESGCM	256	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLSv1.2	ECDHE-RSA-AES128-GCM-SHA256	ECDH	AESGCM	128	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLSv1.2	ECDHE-RSA-CHACHA20-POLY1305	ECDH	ChaCha20	256	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

Security best practices

• Never disable TLS. Sending AUTH PLAIN without STARTTLS would expose your credentials. STACKIT MailOut prevents this by allowing authentication only after STARTTLS
• Keep certificate validation enabled and use TLS 1.3 or TLS 1.3.
• Treat SMTP credentials as secrets — store them securely, never output them in logs or check them into source control systems like Git.
• Use scoped, rotatable credentials where the service allows per-application credentials, so one can be revoked without affecting the others.

Troubleshooting

• “Must issue a STARTTLS command first” / auth rejected without TLS — the client tried to authenticate before encrypting. Enable STARTTLS.
• “Unsupported authentication mechanism” — the client is set to a mechanism the service does not offer (e.g. AUTH LOGIN, CRAM-MD5). Set the method to PLAIN, or let the library auto-negotiate over TLS.
• “Authentication credentials invalid” — wrong username or password. Re-copy them, watch for stray spaces.
• Connection refused or timed out — confirm you are using port 587 and that outbound SMTP is not blocked by your firewall.