Sending over SMTP

If the system that sends only speaks SMTP, nothing in it has to change. The messages come in through the same place and leave in exactly the same way: the same DKIM signature, the same Return-Path, the same events.

The settings

The surprise

The username is ignored. The server does not look at it; authentication is entirely in the password, which is the API key.

It exists because nearly every mail client and SMTP library insists on a username and refuses to authenticate without one. You can put the address you send from, the name of the application, or the word cconnect. It changes nothing.

What decides the sender is the From header of each message, and there you can use any address inside a verified domain of yours:

From: Notifications <notifications@mail.mycompany.com>

We check the domain, never the mailbox.

Authentication only after STARTTLS

The server does not accept AUTH in the clear. The connection opens, the client asks for STARTTLS, and only after that is authentication accepted. A library configured for implicit SSL on port 465 will not connect; use STARTTLS on 587.

An example

Host:       smtp.c-connect.pt
Port:       587
Encryption: tls
Username:   notifications@mail.mycompany.com
Password:   cconnect_xxxxxxxxxxxxxxxxxxxxxxxx

In Laravel, this in .env:

MAIL_MAILER=smtp
MAIL_HOST=smtp.c-connect.pt
MAIL_PORT=587
MAIL_ENCRYPTION=tls
MAIL_USERNAME=notifications@mail.mycompany.com
MAIL_PASSWORD=cconnect_xxxxxxxxxxxxxxxxxxxxxxxx
MAIL_FROM_ADDRESS=notifications@mail.mycompany.com

What differs from the API

Not much, and it is worth knowing what.

• The identifier. The API returns the id in its answer; over SMTP it travels in the Message-ID we write, and reading it means looking at what the server answered to DATA.
• Errors. A 422 from the API is an SMTP 550 with some text, and your client may or may not show it to you.
• One recipient. As on the API, one message per person. Several RCPT TO in the same transaction are treated as separate messages, with separate statuses and separate events.

If you are starting from nothing, use the API. SMTP exists so that nobody has to rewrite a system that already works.

When authentication fails