-The third way, which will override either of the previous two, is to specify a
-"From:" line manually in the message draft. It will be used as provided (after
-alias substitution), but to discourage email forgery, the user's real address
-will be used in the SMTP envelope "From:" and in the "Sender:" line. However,
-if the system administrator has allowed address masquerading by setting
-"mmailid" to non-zero in mts.conf, the SMTP envelope "From:" will use the
-address given in the draft "From:", and there will be no "Sender:" header. This
-is useful in pretending to send mail "directly" from a remote POP3 account, or
-when remote email robots give improper precedence to the envelope "From:". Note
-that your MTA may still reveal your real identity (e.g. sendmail's
-"X-Authentication-Warning:" header).
+The third way is controlled by the "user_extension" value of "masquerade:" line
+of mts.conf. When that's turned on, setting the \fB$USERNAME_EXTENSION\fR
+environment variable will result in its value being appended the user's login
+name. For instance, if I set \fB$USERNAME_EXTENSION\fR to "+www", my "From:"
+line will contain "Dan Harkless <dan+www@machine.company.com>" (or
+"Dan.Harkless+www" if I'm using mmailid masquerading as well). Recent versions
+of sendmail automatically deliver all mail sent to \fIuser\fR+\fIstring\fR to
+\fIuser\fR. qmail has a similar feature which uses '\-' as the delimiter by
+default, but can use other characters as well.
+
+The fourth method of address masquerading is to specify a "From:" line manually
+in the message draft. It will be used as provided (after alias substitution),
+but normally, to discourage email forgery, the user's \fIreal\fR address will be
+used in the SMTP envelope "From:" and in a "Sender:" header. However, if the
+"masquerade:" line of mts.conf contains "draft_from", the SMTP envelope "From:"
+will use the address given in the draft "From:", and there will be no "Sender:"
+header. This is useful in pretending to send mail "directly" from a remote POP3
+account, or when remote email robots give improper precedence to the envelope
+"From:". Note that your MTA may still reveal your real identity (e.g.
+sendmail's "X\-Authentication\-Warning:" header).
+
+If nmh has been compiled with SASL support, the `\-sasl' switch will enable
+the use of SASL authentication with the SMTP MTA. Depending on the
+SASL mechanism used, this may require an additional password prompt from the
+user (but the \*(lq.netrc\*(rq file can be used to store this password).
+`\-saslmech' switch can be used to select a particular SASL mechanism,
+and the the `\-user' switch can be used to select a authorization userid
+to provide to SASL other than the default.
+
+Currently SASL security layers are not supported for SMTP. nmh's SMTP SASL code
+will always negotiate an unencrypted connection. This means that while the SMTP
+authentication can be encrypted, the subsequent data stream can not. This is in
+contrast to nmh's POP3 SASL support, where encryption is supported for both the
+authentication and the data stream.