Question about: Send mail from another address without "on behalf of"

[its]

After setting up the SMTP server, here is the error msg I get:

[Server response: Google tried to deliver your message, but it was
rejected by the recipient domain. We recommend contacting the other
email provider for further information about the cause of this error.
The error that the other server returned was: 500 Remote server does
not support TLS (state 6). code(500) ]

So I emailed Dotster (my hosting company) and here is what they
replied:
"We don't use TLS on our servers of SSL. Please let me know if I can
help you with anything else."

Does that mean that Gmail only uses TLS and because Dotster does not
support it, there is no way I can send mail from another address
without "on behalf of"?

Thank you.

[Zack (Doc)]

According to the Help Center page on this new feature (http://mail.google.com/support/bin/answer.py?hl=en&answer=22370):

"Please note that your other email provider must provide authenticated SMTP support in order for you to use this option."

It's hard to tell from your ISP's response below if they support SSL, but the next sentence in the Help Center says:
"We'll use TLS by default, or SSL if you enable it."

So it should be a setting in your GMail settings that specified the server on Dotster's side.  Ask them if you should be using a different port number for the SSL connection.  If they don't support TLS or SSL, then they don't support authenticated SMTP, and are a target to become an open-relay.  That's a poor configuration.

--

Mark Twain  - "He had discovered a great law of human action, without knowing it - namely, that in order to...

[its]

Thank you for the answer. I am emailing Dotster right now. I am pretty
sure they do support SSL, I just have to figure out how to enable it
on my domain.

> Mark Twain <http://www.quotationspage.com/quote/26717.html>  - "He had

[its]

I got my answer back from Dotster:
"We don't support SSL for e-mail. We only use username and password
authentication."

So that would mean I cannot use the feature?

Thank you.

On Aug 3, 2:38 pm, "Zack (Doc)" <z...@tnan.net> wrote:

> Mark Twain <http://www.quotationspage.com/quote/26717.html>  - "He had

[Nick Chirchirillo]

I assume you have, but just to be sure, have you tried unchecking "Always use a secure connection"?

--
-Nick

[its]

I have tried checking or unchecking it and I always get the same error
msg. I have also double checked the credentials and they are ok.
I have no clue what's going on.

On Aug 4, 7:32 pm, Nick Chirchirillo <nickma...@gmail.com> wrote:
> I assume you have, but just to be sure, have you tried unchecking "Always
> use a secure connection"?
>
>
>
> On Tue, Aug 4, 2009 at 7:14 PM, its <itsan...@gmail.com> wrote:
>
> > I got my answer back from Dotster:
> > "We don't support SSL for e-mail. We only use username and password
> > authentication."
>
> > So that would mean I cannot use the feature?
>
> > Thank you.
>
> > On Aug 3, 2:38 pm, "Zack (Doc)" <z...@tnan.net> wrote:
> > > According to the Help Center page on this new feature (

> >http://mail.google.com/support/bin/answer.py?hl=en&answer=22370)<http://mail.google.com/support/bin/answer.py?hl=en&answer=22370%29>

[Zack (Doc)]

Based on that first sentence I quoted, I'd say no.  Dotster isn't providing authenticated SMTP support, so, not with Dotster you can't.

--

Bertrand Russell  - "Aristotle maintained that women have fewer teeth than men; although he was twice married, it...

[rmacd]

Doc -

On Aug 3, 4:38 pm, "Zack (Doc)" <z...@tnan.net> wrote:
> So it should be a setting in your GMail settings that specified the server
> on Dotster's side. Ask them if you should be using a different port number
> for the SSL connection. If they don't support TLS or SSL, then they don't
> support authenticated SMTP, and are a target to become an open-relay.
> That's a poor configuration.

SMTP-AUTH and TLS are both completely separate mechanisms. SMTP-AUTH
is for the straightforward auth with the MX server, be it plain, cram
md5 or otherwise

TLS OTOH is for peace of mind and is not required (although it is
recommended) for SMTP transactions. Look up RFC-4954. It provides SSL-
based security to as to stop password sniffers picking up the
otherwise plaintext SMTP passwords on the wire.

Therefore, it's not so much a "poor configuration", rather Dotster has
opted not to spend a fortune on signing certificates for each SMTP
server that they operate. That is all!

-Ronald

[Zack (Doc)]

Good point, poor wording on my part.  It's that their SMTP is un-authenticated, but it is insecure.  I'll blame my poor choice of words on the fact I was copying/paraphrasing Google's own Help Article. :)

By not using TLS or SSL, they leave the connection open to sniffing and spoofing, meaning a man-in-the-middle type attack could easily steal your credentials, or even just plain insert material you didn't want into the communication stream.  I think it is because of this insecurity that Google isn't supporting it.  With a secured channel, then can always trace an e-mail back to the real originator, even if they have to bring together multiple log files, but if you allow sending through other SMTP servers, which are not supporting secure channels, they can be used as or made into open-relays, which are the primary spreaders of spam on this planet.