Inbound SMTP Authentication Page

The Inbound SMTP Authentication report page shows the use of client certificates and the SMTP AUTH command to authenticate SMTP sessions between the Email Security appliance and users’ mail clients. If the appliance accepts the certificate or SMTP AUTH command, it will establish a TLS connection to the mail client, which the client will use to send a message. Since it is not possible for the appliance to track these attempts on a per-user basis, the report shows details on SMTP authentication based on the domain name and domain IP address.

Use this report to determine the following information:

  • Overall, how many incoming connection use SMTP authentication?

  • How many connections use a client certificated?

  • How many connections use SMTP AUTH?

  • What domains are failing to connect when attempting to use SMTP authentication?

  • How many connections are successfully using the fall-back when SMTP authentication fails?

To view the Inbound SMTP Authentication report page on the Security Management appliance, select Email from the Product drop-down and choose Monitoring > Inbound SMTP Authentication from the Reports drop-down. For more information, see Using the Interactive Report Pages.

The Inbound SMTP Authentication has two different views:

  • Domains

  • IP Addresses

These views provide a snapshot of the SMTP authentications in the context of the selected view.

The Inbound SMTP Authentication report page includes a graph for received connections, a graph for received recipients who attempted an SMTP authentication connection, and a table with details on the attempts to authenticate connections.

The following list explains the various sections on the Inbound SMTP Authentication report page:

Details on the Inbound SMTP Authentication Page

Section

Description

Time Range (drop-down list)

A drop-down list with options for choosing a time range to view. For more information, see Choosing a Time Range for Reports.

View Data For (drop-down list)

Choose an Email Security appliance for which you want to view the data, or choose All Email Appliances.

See also Viewing Reporting Data for an Appliance or Reporting Group.

Received Connection Graph

The Received Connections graph shows the incoming connections from mail clients that attempt to authentication their connections using SMTP authentication over the time range you specify. The graph displays the total number of connections the appliance received, the number that did not attempt to authenticate using SMTP authentication, the number that failed and succeeded to authenticate the connection using a client certificate, and the number that failed and succeeded to authenticate using the SMTP AUTH command.

Received Recipient Graph

The Received Recipients graph displays the number of recipients whose mail clients attempted to authenticate their connections to the Email Security appliances to send messages using SMTP authentication. The graph also show the number of recipients whose connections were authenticated and the number of recipients whose connections were not authenticated.

SMTP Authentication Details (By Domain Name or IP Address).

The SMTP Authentication Details (by domain name and IP address) table displays details about the users who attempt to authenticate their connections to the Email Security appliance to send messages. For each domain, you can view the number of connection attempts using a client certificate that were successful or failed, the number of connection attempts using the SMTP AUTH command that were successful or failed, and the number that fell back to the SMTP AUTH after their client certificate connection attempt failed.