Verifying MTA for correct behavior with swaks

I'm looking for some advice, what I should to check at my brand new mail-server for it's correct behavior. /saying behavior, because it is working - just but want be sure than it is working correctly./

I don't want get blacklisted only because, for example I forgot disallow plaintext auth.

Want use swaks for verifying functionality "from the internet side".

As first comes to my mind:

1. open relay - should be not allowed
2. as I say above - disallowed plain text auth - allow only over tls.
3. try deliver to nonexistent local user - should fail
4. verify delivery (existence) of the postmaster and abuse aliases (some other is recommented to have?)

so

swaks --to .. --from .. --auth-user name --auth-password pass --protocol SMTP
                                                                ^^^^^^^^^^^^^

If this fails, with the message *** Host did not advertise authentication is enough OK for the 2.?

Any other ideas what I must/should verify? The swaks is great tool - if you know how to use it :) Using "exim" as MTA. What is your favorite swaks tip?

Your example is not sufficient to show that plaintext auth isn't allowed over non-tls connections. --protocol SMTP is explicitly telling swaks NOT to use ESMTP, and ESMTP is required for authentication. In other words, you're testing that auth isn't offered over SMTP, not that plaintext auth isn't offered over plaintext connections. (who's on first!).

The following is closer to what you're looking for:

# These should fail, because you don't want to offer plaintext auth protocols
# over non-tls connections
swaks ... --auth PLAIN --auth-user .. --auth-password ..
swaks ... --auth LOGIN --auth-user .. --auth-password ..

# Should succeed because hashed PW protocols are ok over plaintext (assuming you
# support them at all of course):
swaks ... --auth CRAM-MD5 --auth-user .. --auth-password ..
swaks ... --auth DIGEST-MD5 --auth-user .. --auth-password ..
swaks ... --auth NTLM --auth-user .. --auth-password ..

# The converse of the above, make sure your plaintext password work over tls
# sessions (assuming you want them to, of course)
swaks ... --auth PLAIN --auth-user .. --auth-password .. --tls
swaks ... --auth LOGIN --auth-user .. --auth-password .. --tls
swaks ... --auth CRAM-MD5 --auth-user .. --auth-password .. --tls
swaks ... --auth DIGEST-MD5 --auth-user .. --auth-password .. --tls
swaks ... --auth NTLM --auth-user .. --auth-password .. --tls

Hope that helps, good luck!