Give Indy's SMTP Connection a Proxy IOHandler

Wire SOCKS or HTTP CONNECT into TIdSMTP using the correct Indy version's IOHandler properties, with separate mail and proxy settings.

In Indy, attach the proxy to the IOHandler used by TIdSMTP. Keep TIdSMTP.Host and Port pointed at the mail service. The IOHandler's proxy component supplies the intermediary's address and performs the proxy handshake on that same connection.

The property you use depends on the Indy version: Indy 9 exposes SocksInfo; Indy 10 uses TransparentProxy. Check the component library in the application rather than choosing an example solely from the Delphi release name.

Indy 10 with SOCKS5

Suppose the form already owns these components:

  • Smtp: TIdSMTP
  • MailSocket: TIdIOHandlerStack
  • Socks: TIdSocksInfo

Connect and configure them before opening the SMTP connection:

Smtp.Host := 'smtp.example.net';
Smtp.Port := 587;
Smtp.IOHandler := MailSocket;

Socks.Host := 'proxy.example.net';
Socks.Port := 1080;
Socks.Version := svSocks5;
MailSocket.TransparentProxy := Socks;

The port values are examples. The SMTP port must match the service and TLS mode you intend to use. The SOCKS port belongs to the proxy.

For a permitted public SMTP test where a public intermediary is allowed, the SOCKS5 proxy list offers candidate addresses. Confirm that the candidate permits the actual mail host and port, and use the no-proxy-authentication branch without retaining credentials from an earlier proxy.

TIdSocksInfo starts with svNoSocks, so setting a proxy hostname alone does not enable it. Choose the appropriate SOCKS version. If the proxy requires SOCKS5 username/password authentication, configure the authentication method as well as the credentials:

Socks.Authentication := saUsernamePassword;
Socks.Username := ProxyUser;
Socks.Password := ProxyPassword;

ProxyUser and ProxyPassword represent values supplied by the application. These properties authenticate to the proxy. Configure the SMTP account and its authentication method separately on the mail client.

Keeping an existing TLS IOHandler

A mail client using STARTTLS or implicit TLS needs its SSL-capable IOHandler. Do not replace that component with a plain TIdIOHandlerStack just to add the proxy.

In Indy 10, the SSL IOHandler base descends from TIdIOHandlerStack and inherits its proxy support. For an existing compatible SSL IOHandler named MailTLS, the connection becomes:

Smtp.IOHandler := MailTLS;
MailTLS.TransparentProxy := Socks;

The SMTP component's UseTLS setting still selects the mail service's TLS mode. Configure certificate trust and hostname validation in the TLS integration for smtp.example.net, not for the proxy hostname. Adding a tunnel does not establish certificate validation by itself.

Using an HTTP CONNECT proxy instead

For Indy 10, use a TIdConnectThroughHttpProxy component, available from IdConnectThroughHttpProxy. Assuming an existing form-owned instance named HttpTunnel:

HttpTunnel.Host := 'proxy.example.net';
HttpTunnel.Port := 8080;
HttpTunnel.Enabled := True;
MailSocket.TransparentProxy := HttpTunnel;

If SMTP uses MailTLS, assign HttpTunnel to that handler's TransparentProxy instead. The mail target remains on Smtp.

This component establishes an HTTP CONNECT tunnel and implements Basic proxy authentication through its Username and Password properties. A proxy requiring another authentication mechanism needs a compatible implementation; do not assume these two properties provide every HTTP authentication scheme.

The proxy must also permit CONNECT to the mail server's actual port. Permission to tunnel to web servers on 443 does not imply permission to reach a submission service on 587 or an SMTP server on 25.

The Indy 9 connection

Indy 9 uses a TIdIOHandlerSocket and its SocksInfo property. With form-owned components named Socket9 and Socks9, the equivalent wiring is:

Smtp.IOHandler := Socket9;
Socket9.SocksInfo := Socks9;
Socks9.Host := 'proxy.example.net';
Socks9.Port := 1080;
Socks9.Version := svSocks5;

Its SOCKS implementation supports versions 4, 4a and 5. The Indy 10 TransparentProxy and HTTP CONNECT component arrangement cannot simply be pasted into this older interface.

There is no separate preliminary proxy login to perform with another TCP client. The proxy authentication, tunnel setup and SMTP exchange must belong to the connection the SMTP component actually uses. Once that wiring is correct, a failure can be located at proxy negotiation, the SMTP greeting, TLS or mail authentication instead of treating every refusal as a bad mail password.

Allakkat attuumassuteqartut