The server advertises authentication mechanisms after the client sends EHLO. The client completes one before sending a message.
When does SMTP authentication happen?
A client connects, starts TLS when required, and sends EHLO. The server lists authentication mechanisms in its response. The client then sends AUTH with the mechanism and credentials. After a successful exchange, the client can issue MAIL FROM and continue the SMTP transaction.
RFC 6409 separates message submission from server-to-server relay. It requires submission servers to authenticate clients unless an explicit exception applies. That default prevents unauthorized submission. Use an encrypted connection before sending credentials.
| Mechanism | What it protects or proves |
|---|---|
| TLS | Protects the connection in transit |
| SMTP AUTH | Identifies the submitting client to the relay |
| SPF, DKIM and DMARC | Authorize or verify the sending domain |
RFC 4954 defines the AUTH extension and its success and failure replies. AUTH does not prove that a recipient will accept the message.
Which credentials does SMTP use?
A relay can use a username and password, an API key as the password, or another mechanism it advertises. Treat both parts as secrets. Keep them out of source control and logs because anyone who reads an exposed credential can submit mail as your account.
Authentication proves that the client may submit through that relay. It does not prove that a recipient will accept the message. It does not prove inbox placement. Domain authentication such as SPF, DKIM and DMARC addresses a different part of delivery.
Why can an authenticated send still fail?
The relay can reject credentials, sender permissions, message policy or recipient policy at different stages. Read the SMTP reply code and text, then fix the stage that failed before retrying.
A successful AUTH only completes login. A later RCPT TO reply can still reject the recipient. A receiving provider can still filter an accepted message.
C: EHLO app.example
S: 250-AUTH PLAIN LOGIN
C: STARTTLS
S: 220 Ready to start TLS
C: EHLO app.example
C: AUTH <credentials omitted>
S: 235 Authentication successfulThe server returns 535 when authentication fails. Never place a real password or base64 credential in a log or example. Anyone who reads it could submit mail as your account.
How do I authenticate with Bird?
Use the SMTP host for your key's region. Choose port 587 with STARTTLS or port 465 with implicit TLS. Authenticate with username bird and an API key with emails scope as the password. The SMTP relay guide shows the connection settings and reply handling.
In short
- SMTP authentication proves a client may submit through a relay.
- Authenticate after encryption is active.
- Login success does not guarantee delivery or inbox placement.
- Bird uses
birdas the username and the API key as the password.
