Hey hs0204,
1. If SMTP auth, will/can it bypass DMARC?
- It's dependent on the mail flow policy configuration - so for your SMTP Auth mail flow policy you configure - you can keep SPF, DKIM and DMARC enabled and it will still do it's check. SMTP Auth just allows an external user to authenticate into your environment to send an outbound email :).
2. How to check if user is allowed to use SMTP AUTH command using an Active Directory/LDAP group
- That would be creating your LDAP profile (assuming it's not there) and if it is enabled; scroll down to enable the smtp-auth query and depending on your attribute checking with LDAP; that will determine who can and cannot. These attributes in the query can be modified to suit your needs. After that is done you need to create an SMTP Authentication profile using LDAP; then enabling this profile into the listener which the users are going to auth on... then you also need to create a new sendergroup + mail flow policy to trigger AUTH (https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118545-technote-esa-00.html)
There is some best practises I would comment on SMTP Auth as well but this is the current guidance for you.
3. How to use SMTP AUTH Client certificate and require the cert to have a subject name *.abc.com or a specific organization name.
I don't recall SMTP Auth with LDAP requiring certificate authentication.
Thanks,
Mathew
