starred/mailpit

Fork 0

mirror of https://github.com/axllent/mailpit.git synced 2026-04-26 00:35:51 +03:00

[GH-ISSUE #550] How to include username and password for sendmail? #355

New issue

Closed

opened 2026-03-15 14:03:51 +03:00 by kerem · 5 comments

kerem commented

2026-03-15 14:03:51 +03:00

Owner

Originally created by @mbomb007 on GitHub (Aug 13, 2025).
Original GitHub issue: https://github.com/axllent/mailpit/issues/550

The docs describe how to require username/password for SMTP.

https://mailpit.axllent.org/docs/configuration/smtp/

However, the docs for sendmail don't show a way to include the defined credentials, and sendmail doesn't work anymore if I use something like this:

sendmail_path = /usr/local/bin/mailpit --smtp-auth-file /etc/mailpit-smtp-creds sendmail -t

https://mailpit.axllent.org/docs/install/sendmail/

How does one do this?

Originally created by @mbomb007 on GitHub (Aug 13, 2025). Original GitHub issue: https://github.com/axllent/mailpit/issues/550 The docs describe how to require username/password for SMTP. https://mailpit.axllent.org/docs/configuration/smtp/ However, the docs for sendmail don't show a way to include the defined credentials, and sendmail doesn't work anymore if I use something like this: ```ini sendmail_path = /usr/local/bin/mailpit --smtp-auth-file /etc/mailpit-smtp-creds sendmail -t ``` https://mailpit.axllent.org/docs/install/sendmail/ How does one do this?

kerem closed this issue

2026-03-15 14:03:56 +03:00

kerem commented

2026-03-15 14:04:02 +03:00

Author

Owner

@axllent commented on GitHub (Aug 14, 2025):

Hi @mbomb007. There isn't currently any way to configure the sendmail CLI with authentication. This was an intentional decision made based on the fact that the majority (if not all) of other sendmail clients do not support authentication. Typically if you're wanting to use authentication then you would be sending emails with an SMTP-compliant application (ie: the application does the SMTP exchange for you, rather than routing via sendmail). The --smtp-auth-file option is for the SMTP (SMTP server), not the sendmail client.

Can you please provide a bit more information about your setup and why you need sendmail to support authentication?

@axllent commented on GitHub (Aug 14, 2025): Hi @mbomb007. There isn't currently any way to configure the sendmail CLI with authentication. This was an intentional decision made based on the fact that the majority (if not all) of other sendmail clients do not support authentication. Typically if you're wanting to use authentication then you would be sending emails with an SMTP-compliant application (ie: the application does the SMTP exchange for you, rather than routing via sendmail). The `--smtp-auth-file` option is for the SMTP (SMTP server), not the sendmail client. Can you please provide a bit more information about your setup and why you need sendmail to support authentication?

kerem commented

2026-03-15 14:04:07 +03:00

Author

Owner

@mbomb007 commented on GitHub (Aug 14, 2025):

I'm using sendmail to send mail to the SMTP server. However, the SMTP server continues to show up in security scans as unsecured, since any machine can send email to the port (testable using telnet). I only use the server for mail from localhost, so I was trying to require a password on the server and have sendmail use it.

@mbomb007 commented on GitHub (Aug 14, 2025): I'm using sendmail to send mail to the SMTP server. However, the SMTP server continues to show up in security scans as unsecured, since any machine can send email to the port (testable using telnet). I only use the server for mail from localhost, so I was trying to require a password on the server and have sendmail use it.

kerem commented

2026-03-15 14:04:12 +03:00

Author

Owner

@mbomb007 commented on GitHub (Aug 14, 2025):

In the end, though, we did decide it wasn't a real vulnerability, since the mail just ends up in the pit (relay defaults to off) and the only risk is malicious links in a suspicious email. Since sendmail can't be configured that way, I think if I wanted to secure it I would have to use a firewall rule.

@mbomb007 commented on GitHub (Aug 14, 2025): In the end, though, we did decide it wasn't a real vulnerability, since the mail just ends up in the pit (relay defaults to off) and the only risk is malicious links in a suspicious email. Since sendmail can't be configured that way, I think if I wanted to secure it I would have to use a firewall rule.

kerem commented

2026-03-15 14:04:17 +03:00

Author

Owner

@axllent commented on GitHub (Aug 14, 2025):

You can also tell Mailpit to only listen locally for SMTP connections using --smtp 127.0.0.1:1025 or MP_SMTP_BIND_ADDR="127.0.0.1:1025".

@axllent commented on GitHub (Aug 14, 2025): You can also tell Mailpit to only listen locally for SMTP connections using `--smtp 127.0.0.1:1025` or `MP_SMTP_BIND_ADDR="127.0.0.1:1025"`.

kerem commented

2026-03-15 14:04:22 +03:00

Author

Owner

@mbomb007 commented on GitHub (Aug 14, 2025):

Ah, that's helpful. Thank you!

@mbomb007 commented on GitHub (Aug 14, 2025): Ah, that's helpful. Thank you!

kerem referenced this issue

2026-03-15 14:23:41 +03:00

[PR #355] [CLOSED] Chore: Bump bootstrap5-tags from 1.7.4 to 1.7.5 #525