Updated: February 27, 2027
Here’s the thing about email security. Most business owners don’t think about it until something goes wrong. And by then, you’re already dealing with blacklisted domains, spam complaints from customers, and a massive cleanup bill.
Your Microsoft 365 or Exchange server sends emails every day. Purchase orders go out through Dynamics GP. Sales quotes flow through SalesPad. Invoices print and email through Forms Printer. All of that runs on SMTP connections behind the scenes. And if those connections aren’t locked down properly, you’ve left the door wide open.
Why Basic Authentication Is a Problem
Basic authentication sends your username and password directly to the mail server. Think of it like shouting your password across a crowded room. If you’re not using SSL/TLS encryption on that connection, those credentials travel in plain text. Anyone sitting on your network can grab them.
According to F5 Labs, SSLstrip attacks, which downgrade encrypted connections to unencrypted HTTP, are actively being used to steal login credentials in real-world scenarios. The Verizon 2025 Data Breach Investigations Report found that 88% of basic web application attacks involved stolen credentials, with unencrypted connections making credential theft significantly easier.
Most Microsoft 365 tenants now block basic authentication by default. Microsoft deprecated basic authentication for good reason. But plenty of companies are using workarounds to keep it running. That’s a mistake.
Look, we get it. Switching to OAuth takes time. You have to reconfigure applications. But OAuth works differently. When an app tries to connect, you get a permission screen showing exactly what access it’s requesting. Same idea as installing an app on your phone and seeing what permissions it wants. You review it, accept it, and the connection happens with better security.
The key difference is control. With basic auth, once an application has your credentials, it has full access until you change the password. With OAuth, you grant specific permissions and can revoke them anytime without touching your main account credentials. That matters when you’re dealing with third-party applications connecting to your mail server.
The Open Relay Problem
We’ve seen too many Exchange servers configured with open SMTP relay connectors. These let email flow through without authentication. The thinking goes like this: “We’ll just restrict it to our internal IP addresses. That’s secure enough.”
It’s not.
Even with IP restrictions, attackers who gain access to your network can exploit that relay. Your mail server should enforce both encryption and authentication. Yes, restrict by IP address. But add authentication on top of that. Make the connection prove it’s coming from a trusted source and verify it with legitimate credentials.
SSL/TLS encryption adds another layer. The traffic itself gets encrypted. That makes intercepting credentials or email content much harder. Modern mail servers support TLS 1.2 or higher. There’s no good reason to allow unencrypted connections in 2026.
What Happens When Security Fails
A few years back, one of our clients learned this lesson the expensive way. They had an in-house EDI application that transmitted data to their warehouse system. The application sent email notifications through an unauthenticated relay on their Exchange server.
A hacker found a backdoor in that EDI app. Once inside, they discovered the open relay and started sending spam. Thousands of emails went out. Because they originated from a legitimate, trusted mail server, spam filters didn’t catch them.
The client’s domain got blacklisted. They spent days contacting blacklist providers to get removed. They had to trace how the attack happened. They reconfigured their mail server and updated the EDI application to use proper authentication. All of that could have been prevented with correct configuration from the start.
The reputational damage hurt too. Many spam recipients were their actual business partners. The client initially thought an employee’s email account got compromised. The reality was worse. They’re a public manufacturing company with products sold in retail stores worldwide. Their website proudly lists every retailer that carries their products. The attacker just scraped that public “where to buy” page and grabbed contact information for all those retailers.
How to Lock Down SMTP Properly
Modern mail servers give you the tools. Configure your SMTP connections to require authentication. Use OAuth where your applications support it. Enforce SSL/TLS encryption on every connection. Reject unencrypted traffic.
For Dynamics GP environments running third-party tools like SalesPad or Forms Printer, SMTP is still legitimate. But configure it right. Don’t accept the defaults. Don’t take shortcuts with open relays or basic authentication just because it’s easier to set up.
Start by auditing what SMTP connections currently exist in your environment. Check which applications are sending email. Verify what authentication method each one uses. Document which connectors are configured on your Exchange or Microsoft 365 tenant. You can’t secure what you don’t know exists.
The National Institute of Standards and Technology recommends multi-factor authentication and encrypted connections for all email systems. These aren’t suggestions for enterprises only. Mid-market manufacturers and distributors face the same threats. Attackers don’t care about company size. They care about easy targets.
Getting Your Configuration Reviewed
If you’re running Exchange, Microsoft 365, or any mail server that connects to your ERP system, you should verify your SMTP security settings. Check what authentication method you’re using. Confirm encryption is enforced. Make sure you don’t have an open relay sitting there waiting to be exploited.
We review mail server configurations as part of our ERP implementation and support services. Rob and our infrastructure team can audit your current setup, identify vulnerabilities, and help you reconfigure everything properly. It’s faster and cheaper than cleaning up after an attack.
Your email server shouldn’t be your weakest security link. Let’s make sure it isn’t.
By CAL Business Solutions, Connecticut Acumatica & Microsoft Dynamics 365 BC/GP Partner, www.calszone.com
