IBM Support

Configuring TLS Between IBM i and Remote Mail Router WITHOUT Authentication

Question & Answer


Question

How can I configure SMTP on the IBM i to connect to a mail router using TLS without requiring authentication?

Answer

Prerequisite:
The following PTF must be applied to allow the STARTTLS command to be executed when the Forwarding Mailhub Server SMTP Attribute is resolved via a DNS MX record.

IBM i 7.5 & 7.4: Included in GA
IBM i 7.3: 5770TC1 - SI69785 (*SMTP e-mail directory type)
IBM i 7.3: 5770TC1 - SI73016 (*SDD e-mail directory type)


If these PTFs are not applied, then you will need to set the 'Forwarding Mailhub Server' to either the direct IP address of the mail router, or an alias that is resolved in CFGTCP opt. 10 (for example SMTPRELAY) and ensure environment variable has been added/updated: ADDENVVAR ENVVAR(QIBM_SMTP_RLY_TLS_FIRST) VALUE(YES) LEVEL(*SYS) REPLACE(*YES)


To configure IBM i SMTP client without requiring authentication (AUTH) and explicitly request STARTTLS method, you will need to do the following:

1) Add the QIBM_SMTP_RLY_TLS_FIRST environment variable at the *SYS level with the appropriate value.

If the prerequisite PTF is applied:
ADDENVVAR ENVVAR(QIBM_SMTP_RLY_TLS_FIRST) VALUE(YES_STARTTLS) LEVEL(*SYS) REPLACE(*YES)

If the prerequisite PTF is NOT applied:
ADDENVVAR ENVVAR(QIBM_SMTP_RLY_TLS_FIRST) VALUE(YES) LEVEL(*SYS) REPLACE(*YES)

NOTE: If the prerequisite PTF is not applied, then you will need to set the 'Forwarding Mailhub Server' to either the direct IP address of the mail router, or an alias that is resolved in CFGTCP opt. 10 (for example SMTPRELAY) and you will need to use the QIBM_SMTP_RLY_TLS_FIRST=YES environment variable value.

2) Restart SMTP services.

ENDTCPSVR *SMTP
STRTCPSVR *SMTP

3) Optional: Depending on your current SMTP relay requirements, you may need to still complete the rest of the configuration steps for SMTP client authentication outlined in technote: https://www.ibm.com/support/pages/node/643091 to setup your certificates and port. You can skip step 7) since we have disabled AUTH request. Please consult your SMTP relay administrator/vendor for exact authentication requirements.

[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CINAA2","label":"Email and SMTP-\u003ESetup and Configure"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"All Versions"}]

Document Information

Modified date:
02 March 2026

UID

nas8N1020864

Page Feedback