<< 0015 AUTH CRAM-MD5
>> 0046 334 PDM2MDkuMTIyMzU2MjUwNEBpc3AuYXR0Lm5ldD4=
<< 0070 andqb2huc29AYXR0Lm5ldCAxMDAzNGFjNzBiZDg5OTZkYjVhNjRkZDU4NGVmMWQyZA==
>> 0028 535 Authentication failure
It does look like you are doing a proper CRAM_MD5 authorization since you are sending back your email address and encoded password. I would also try using the simple username and password though to see if this helps. That said, the problem might be that AT&T is not really doing a CRAM-MD5, many ISPs do not. If you get PB1 you can set up the SMTP to not use CRAM-MD5. From the PB1 help:
<blockquote>&lt;&lt; 0015 AUTH CRAM-MD5
&gt;&gt; 0046 334 PDM2MDkuMTIyMzU2MjUwNEBpc3AuYXR0Lm5ldD4=
&lt;&lt; 0070 andqb2huc29AYXR0Lm5ldCAxMDAzNGFjNzBiZDg5OTZkYjVhNjRkZDU4NGVmMWQyZA==
&gt;&gt; 0028 535 Authentication failure
</blockquote><p>It does look like you are doing a proper CRAM_MD5 authorization since you are sending back your email address and encoded password. &nbsp; I would also try using the simple username and password though to see if this helps.&nbsp; That said, the problem might be that AT&amp;T is not really doing a CRAM-MD5, many ISPs do not.&nbsp; If you get PB1 you can set up the SMTP to not use CRAM-MD5.&nbsp; From the PB1 help:
</p><i><b>Do not use CRAM-MD5 authentication even if it is advertised&nbsp;</b></i> This one's a bit technical, so please bear with us... The process of logging into the SMTP server to authenticate your identity can take a variety of forms: the server "advertises" the forms it understands, and Pegasus Mail looks through that list, choosing the most secure form it recognizes. Some forms are very "weak", in that they either transmit your credentials as clear text or in a form that can be easily broken, while other forms are "strong", in the sense that it is very difficult to work out your credentials simply by observing the exchange of data between the two programs. Unfortunately, one of the strongest forms of authentication, called CRAM-MD5, is commonly misconfigured on SMTP servers, even at quite reputable ISPs - the server will advertise that it supports it, but will actually fail any attempt to use it. Getting the ISP to realize that they are at fault is a lost cause in most cases - it's almost always easier simply to check this control, which tells Pegasus Mail never to use CRAM-MD5 for this server. You should be aware that you reduce the security of your connection by checking this control: CRAM-MD5 is the only commonly-used authentication form that offers reasonable security, and by disabling it, you force Pegasus Mail to use less secure methods... But sometimes you may decide that being able to send mail is more important than being able to do it securely. The choice is yours.
