dont exactly understand SMTP authentication

if someone can tak the time to help me out id really appreciate it. im
trying to understand the smtp configuration in IIS and am really confused
about something. i have read several times in the past few days that, and i
quote "an smtp server RARELY requires authentication". if thats true,
wouldnt that make the server an open relay? i dont get it. this all started
because im writing a vb application that will allow a user to send an email
by specifying an smpt server and optionally a username and password. in
testing out different mail objects with different servers, i am now very
confused. if im in my office, and use smtp to send an email with my internal
exchange server, i dont need to authenticate, even if im not logged into the
domain. how and why is this? how does the server know who i am? and ive also
tested my application out with external smtp server on the internet that i
have valid accounts with.... however when i used those servers if i dont
send username/password sometimes the mail still goes through. again... im
confused. can anyone shed some clear light on my problem?

Hello,
Mostly it seems that in both cases you sent the mail
to an account which was local for the respective mail
servers.
Is this correct? If yes, then please note that for local
users, SMTP Authentication is not required!

If this is not correct, then lemme know and I can give
you some idea what could be happening.

Sharad
>-----Original Message-----
>if someone can tak the time to help me out id really
appreciate it. im
>trying to understand the smtp configuration in IIS and am
really confused
>about something. i have read several times in the past
few days that, and i
>quote "an smtp server RARELY requires authentication". if
thats true,
>wouldnt that make the server an open relay? i dont get
it. this all started
>because im writing a vb application that will allow a
user to send an email
>by specifying an smpt server and optionally a username
and password. in
>testing out different mail objects with different
servers, i am now very
>confused. if im in my office, and use smtp to send an
email with my internal
>exchange server, i dont need to authenticate, even if im
not logged into the
>domain. how and why is this? how does the server know who
i am? and ive also
>tested my application out with external smtp server on
the internet that i
>have valid accounts with.... however when i used those
servers if i dont
>send username/password sometimes the mail still goes
through. again... im
>confused. can anyone shed some clear light on my problem?
>
>
>.
>