SQL Server 2017 in Azure Cloud config DB Mail

Question

I have set up a SQL Server 2017 in Azure cloud. I have created a new GMX email address and enabled it for pop3 external programs

I have set up db mail on the SQL Server but I am getting the following auth error

The mail could not be sent to the recipients because of the mail server failure. (Sending Mail using Account 1 (2020-01-25T12:14:37).

Exception Message: Cannot send mails to mail server. (The SMTP server requires a secure connection or the client was not authenticated. The server response was: Authentication required). )

I have tried ports 25 and 587 with/without SSL enabled on server mail.gmx.com.

I have checked the network for Azure ports and AllowInternetOutBound is enabled and set to any.

Any assistance would be great, thanks in advance

Answer 1

SQL Server only supports sending email via SMTP using Basic Authentication without TLS/encryption. Basic Authentication means that the client application passes the username and password with every request. Basic Authentication makes it easier for attackers armed with today’s tools and methods to capture users’ credentials.

Many email providers are ending support for unencrypted/non-secure SMTP connections because of the risk involved. I don't know if mail.gmx.com supports non-secure connections, but it would not be surprising if they are forcing secure connections, even on port 25 (traditionally for non-secure connections).

Additionally, I notice you mention that you have "created a new GMX email address and enabled it for pop3 external programs." I'm not familiar with GMX, but you will need to have SMTP enabled, not POP to send mail. Perhaps GMX has one configuration switch that controls POP3 & SMTP jointly, but it's worth double-checking to make sure you really have SMTP enabled.

At most of my prior employers, we white list our DB Servers to send mail without authentication via corporate mail relay servers. This vastly simplifies the mail setup, by eliminating the authentication hassle. This is possible because the network & security is more tightly controlled on an internal network, minimizing the possibility of an unauthorized user running a spambot via unauthenticated SMTP.