AUTH (SASL) Mechanisms

To send mail, MSAs require authentication. SMTP uses SASL (RFC 4422) for pluggable auth.

C: AUTH PLAIN
S: 334
C: <base64(\0username\0password)>
S: 235 OK

Or one-step:

C: AUTH PLAIN <base64(\0user\0pass)>
S: 235 OK

Mechanisms:

• PLAIN: cleartext (over TLS only). User + pass in base64. Standard.
• LOGIN: same idea but two-step (user, then pass), base64 each. Microsoft legacy.
• CRAM-MD5: server sends nonce; client sends HMAC-MD5(password, nonce). Server stores password (or compatible derivation). Defends against passive eavesdroppers but server has plaintext.
• DIGEST-MD5: more sophisticated challenge-response. Mostly deprecated.
• SCRAM-SHA-256 (RFC 7677): salted challenge-response, password-storage-friendly. Modern default.
• OAUTHBEARER: bearer token (Gmail, Outlook OAuth flow). Replaces password auth.
• GSSAPI: Kerberos. Enterprise.
• EXTERNAL: derived from TLS client cert.

Base64-encoded payload:

Modern best practice:

• Require TLS before AUTH (advertise AUTH only post-STARTTLS).
• Don't store plaintext passwords. Use bcrypt/scrypt/argon2.
• Allow only PLAIN (over TLS) + OAUTHBEARER for modern services.
• Rate limit + lockout after failed attempts.

Submission port (587) requires AUTH. Port 25 generally does NOT (server-to-server uses other authentication via SPF/DKIM).