Search code examples
phpexim

PHPMailer Authentication vs No authenication


There seems to be no difference when we send mail via PHPMailer whether we set $mail->SMTPAuth = true; or $mail->SMTPAuth = false;

We found only a one letter difference in the header of the email sent: with esmtpa (Exim 4.82) instead of with esmtp (Exim 4.82) on the "Received" header line.

What are the benefits of using authentication? Does that one letter help them not go to spam or anything else beneficial?


Solution

  • Authentication is needed when your SMTP server needs you to login to send mail at all. Quite often, you can send e-mail without authentication when you send through your ISP. They already know it is you by the fact that you connected, so extra authentication is not necessary.

    PHPMailer can use a variety of ways to send the actual mail. One of them is PHP's mail() function, which might already be configured in your server configuration. So it could be that your SMTP server does need authentiction, but those credentials are already configured.

    Either way, it looks like you don't need to configure authentication to send the mail. So this property has no effect apart from that single letter in the header.

    It seems that the extra a in the header does indeed refer to the fact that authentication was used. This is described in this RFC. This header can easily be spoofed though, and it even says in the RFC that you should not use this header as a spam detection method. Nevertheless, I think it can't hurt to have this header, just in case. That one byte won't cost you much.