The JavaMail API supports a debugging option that will can be very useful if you run into problems. You can activate debugging on any of the mail classes by calling setDebug(true). The debugging output will be written to System.out.

Sometimes you want to experiment with various security setting or features of commons-email. A good starting point is the test class EmailLiveTest and EmailConfigurationwhich are used for testing commons-email with real SMTP servers.

Authentication

If you need to authenticate to your SMTP server, you can call the setAuthentication(userName,password) method before sending your email. This will create an instance ofDefaultAuthenticator which will be used by the JavaMail API when the email is sent. Your server must support RFC2554 in order for this to work.

You can perform a more complex authentication method such as displaying a dialog box to the user by creating a subclass of the javax.mail.Authenticator object. You will need to override the getPasswordAuthentication() method where you will handle collecting the user's information. To make use of your new Authenticator class, use theEmail.setAuthenticator method.

Security

Nowadays you should not use plain SMTP protocol when using public SMTP servers but there is a some confusion regarding the available options.

Two commons options are using

• STARTTLS on port 25
• SSL on port 465

The following definitions were taken from Wikipedia

• STARTTLS is an extension to plain text communication protocols, which offers a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate port for encrypted communication.
• Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide communication security over the Internet.TLS and SSL encrypt the segments of network connections above the Transport Layer, using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity.

In addition you can force the following security checks (which are disabled by default)

• When using a secured transport (STARTTLS or SSL) you can force validating the server's certificate by calling Email.setSSLCheckServerIdentity(true). Having said that this does not seem to work on any of my test servers (GMAIL, GMX).
• Enforce using STARTTLS by calling Email.setStartTLSRequired(true)

Handling Bounced Messages

Normally, messages which cannot be delivered to a recipient are returned to the sender (specified with the from property). However, in some cases, you'll want these to be sent to a different address. To do this, simply call the setBounceAddress(emailAddressString) method before sending your email.

Technical notes: When SMTP servers cannot deliver mail, they do not pay any attention to the contents of the message to determine where the error notification should be sent. Rather, they refer to the SMTP "envelope sender" value. JavaMail sets this value according to the value of the mail.smtp.from property on the JavaMail Session. (Commons Email initializes the JavaMail Session using System.getProperties()) If this property has not been set, then JavaMail uses the "from" address. If your email bean has the bounceAddress property set, then Commons Email uses it to set the value of mail.smtp.from when the Session is initialized, overriding any other value which might have been set.

Note: This is the only way to control the handling of bounced email. Specifically, the "Errors-to:" SMTP header is deprecated and cannot be trusted to control how a bounced message will be handled. Also note that it is considered bad practice to send email with an untrusted "from" address unless you also set the bounce address. If your application allows users to enter an address which is used as the "from" address on an email, you should be sure to set the bounce address to a known good address.