We have an issue where we have a business application that sends emails via a SMTP relay (Microsoft IIS) .
Authentication is set to "Anonymous Access", Relay Restrictions set to a list of servers that is allowed to Relay From.
So two things, one, we now want to deploy this app to all users thick clients, which means we either need to lift the restriction or find another authentication mechanism. I personally dont want to open up all internal subnets to be able to relay, especially if a malware begins spamming.
What are my other options? Ideally, I would like to allow all internal subnects to relay but place a service account username and password in the app (which we can do as the app is internally developed) which only that account has rights to relay. Can I do this?
I don't want to use Integrated AD authentication or Exchange Authentication as an malware can just pass the user credentials the user has already logged into their thick clients with.
Or is there a better solution that I should look at? What is the best practice around this?
Thanks in advance.