Rotating your smarthost credentials safely

One advantage of SMTP-authentication mode over the IP allowlist is that the per-domain username and password can be rotated freely. Rotate them if a credential may have leaked, when staff who knew them leave, or just on a routine schedule.

How to rotate without an outage: 1. Generate the new credentials for the domain in the dashboard. 2. Update the stored password on your mail server — for Postfix, edit /etc/postfix/sasl_passwd and re-run postmap; for Exim, update the authenticator's stored secret. 3. Reload the mail server so it picks up the new secret. 4. Send a test message and confirm it's accepted (check the outbound log). 5. Retire the old credentials.

Because the credentials constrain sending to your own domain, a leaked password can't be used to spoof other customers — but it could be used to send as you, so treat it as a secret and rotate promptly if in doubt. If you use IP-allowlist mode there are no credentials to rotate; instead keep the registered IP list accurate.