How To Collection

Scenario:
You want to run a public SMTP with a secured relay.

Solutions:

Generally:
- For your LAN users you CAN (if you want) set smtprelay.tab 
 to the scope of your subnet. 
 Members of that subnet are then able to relay without authentication.
- Domain members outside that scope MUST HAVE a valid user account 
 in the XMail server/domain.
- Do NOT use mail-auth in your server.tab. 
 This blocks all mails from other SMTPs, 
 because they cannot authenticate with your system. 
 This authentication scheme is meant for private 
 or complex public infrastructures. 
 So make sure #"SmtpConfig"[TAB]"mail-auth" 
 _remains commented out_ in your server.tab.

Pop_before_SMTP:
- When your users poll mail, they do a POP_before_SMTP, 
	which authenticates them as valid users.
- XMail then opens the SMTP relay for a short time frame 
	(900 sec by default) and only for that user.
- Make sure that #"EnableAuthSMTP-POP3"[TAB]"0" 
	is commented out with a # in your server.tab.

SMTP AUTH:
- Set "SMTP Server requires authentication" on your mail client.
- XMail automatically handles that client request 
	and sends mail only to authenticated users.
- Make sure that "EnableAuthSMTP-POP3"[TAB]"0" 
	is NOT commented out with a # in your server.tab.

You can also allow both: Pop_before_SMTP and SMTP Auth 
for a more loose security policy.
If possible, you should prefer SMTP Auth only, since it is more secure.

smtp.ipmap.tab should be in most cases set to
"0.0.0.0"[TAB]"0.0.0.0"[TAB]"ALLOW"[TAB]"1"[NEWLINE]

smtprelay.tab MUST be set to "127.0.0.1"[TAB]"255.0.0.0"
in case of web-mail access (SmartPost web-mail for example) 
with Apache installed on the same box as XMail MTA 
(set Apache's IP there otherwise)
This is because most web-access clients (including SmartPost)
do not support SMTP authentication.

Conclusion:
A spammer can only use the server's relay, if he has the username 
and password of a valid domain account or another backdoor.