Authentication directive

allow-unencrypted-plain-auth

Control whether plaintext authentication may occur without TLS.

Purpose

Control whether plaintext authentication may occur without TLS. This reference focuses on operational intent, placement, validation, and failure modes rather than presenting a value as universally safe.

Example syntax

allow-unencrypted-plain-auth no

Placement and scope

The effective scope depends on where the directive is placed: global, source, SMTP user, virtual MTA, pool, or destination domain. Keep related controls together and comment the business purpose of each override.

Verification procedure

1. Back up the active configuration and included files.
2. Confirm the directive is supported by the installed PowerMTA release.
3. Validate every referenced VMTA, pool, file, hostname, IP address, selector, and pattern list.
4. Reload safely and watch the main log for parser or runtime errors.
5. Send a controlled test and inspect the exact source IP, EHLO, headers, TLS state, and SMTP response.

Common failure modes

• Placing the directive in a scope where it is ignored or overridden.
• Referencing an object that is misspelled or not defined.
• Copying syntax from a different PowerMTA version.
• Using aggressive values without measuring provider acceptance and queue age.

Related resources