We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the Internet.
Now we need to decide (as part of the product management) if either emails without authentication should be allowed or if username and password should be required.
Our questions are:
- Do security policies generally recommend to just run closed relays requiring authentication?
- Or do these policies enforce open relays motivated by GDPR requirements in order to avoid tracking employees?