Use Authenticated mode when possible
Authenticated mode supports SMTP AUTH LOGIN and AUTH PLAIN. RelayBridge generates a device-specific username and a 192-bit one-time password. It stores a salted PBKDF2-HMAC-SHA256 verifier rather than the plaintext password.
Authentication is only one control. The connection must also originate from the configured source address or subnet, and the SMTP envelope sender must match the device's exact sender allowlist.
- The generated password is displayed once and cannot be recovered later.
- Password reset immediately invalidates the previous password.
- Disabling a device rejects new sessions while retaining its configuration and history.
- Inbound STARTTLS is unavailable, so the reusable credential crosses the trusted device LAN in cleartext.
Use Legacy mode only when authentication is impossible
Legacy mode accepts no password. It therefore depends on a stable private source address or narrow subnet and an exact sender restriction. RC1 rejects public, wildcard, and unrestricted Legacy rules.
Reserve a stable private address for the device, keep the envelope sender exact, and prevent untrusted systems from reaching the listener. Do not switch to Legacy merely to work around a credential configuration error.
Authorization checks before acceptance
| Control | Authenticated | Legacy |
|---|---|---|
| Private source rule | Required | Required; public and unrestricted rules rejected |
| Envelope sender rule | Required | Required |
| Device credential | Required | Not used |
| Inbound TLS | Not available | Not available |
| Appropriate network | Trusted private LAN | Tightly controlled trusted private LAN |
RelayBridge evaluates the actual connection source and SMTP envelope sender, not only the message-header From value. The queued envelope sender must also match the active sender authorized through Exchange Application RBAC.
Listener scope
RC1 implements bounded HELO/EHLO, AUTH LOGIN, AUTH PLAIN, MAIL, RCPT, DATA, RSET, NOOP, QUIT, and SIZE handling. It does not advertise inbound STARTTLS, 8BITMIME, or SMTPUTF8.
Keep the listener bound to the one selected private interface and use a narrow firewall rule if required. Management remains on loopback and must not be opened to devices.