1f50e55
diff --git a/src/configure.default b/src/configure.default
1f50e55
index 0126880..b7c30ac 100644
1f50e55
--- a/src/configure.default
1f50e55
+++ b/src/configure.default
1f50e55
@@ -796,6 +796,15 @@ begin transports
be2d766
 remote_smtp:
be2d766
   driver = smtp
be2d766
 
be2d766
+# This transport is used for delivering messages over SMTP using the
be2d766
+# "message submission" port (RFC4409).
be2d766
+
be2d766
+remote_msa:
be2d766
+  driver = smtp
5f2a3a9
+  port = 587
be2d766
+  hosts_require_auth = *
be2d766
+
be2d766
+
be2d766
 # This transport invokes procmail to deliver mail
be2d766
 procmail:
be2d766
   driver = pipe
1f50e55
@@ -904,6 +913,21 @@ begin rewrite
be2d766
 #                   AUTHENTICATION CONFIGURATION                     #
be2d766
 ######################################################################
be2d766
 
be2d766
+begin authenticators
be2d766
+
be2d766
+# This authenticator supports CRAM-MD5 username/password authentication
be2d766
+# with Exim acting as a _client_, as it might when sending its outgoing
be2d766
+# mail to a smarthost rather than directly to the final recipient.
be2d766
+# Replace SMTPAUTH_USERNAME and SMTPAUTH_PASSWORD as appropriate.
be2d766
+
be2d766
+#client_auth:
be2d766
+#  driver = cram_md5
be2d766
+#  public_name = CRAM-MD5
be2d766
+#  client_name = SMTPAUTH_USERNAME
be2d766
+#  client_secret = SMTPAUTH_PASSWORD
be2d766
+
be2d766
+#
be2d766
+
be2d766
 # The following authenticators support plaintext username/password
be2d766
 # authentication using the standard PLAIN mechanism and the traditional
be2d766
 # but non-standard LOGIN mechanism, with Exim acting as the server.
1f50e55
@@ -919,7 +943,7 @@ begin rewrite
be2d766
 # The default RCPT ACL checks for successful authentication, and will accept
be2d766
 # messages from authenticated users from anywhere on the Internet.
be2d766
 
be2d766
-begin authenticators
1f50e55
+#
be2d766
 
be2d766
 # PLAIN authentication has no server prompts. The client sends its
be2d766
 # credentials in one lump, containing an authorization ID (which we do not