Server Switching from STARTTLS to AUTH DIGEST-MD5

Question

We have been trying to track down the reason why our transaction against our Tumbleweed SMTP servers appear to be switching in midstream from STARTTLS to AUTH DIGEST-MD5 which causes us to get an authentication error. With Wire-shark, we have been capturing the transactions between the servers and CF appears it appears to be the culprit. I am hoping someone can shed some light on what is wrong or direct me on how I can further troubleshoot this issue.
---Enviroment --------------------------------------------------------------------------
Windows Server 2003 Standard
IIS6
CF 9 Standard
---CFMail Tag -------------------------------------------------------------------------
<cfmail to="#varTo#" from="#varFrom#" replyto="#varReplayTo#" subject="#varSubject#" useTLS="yes">Msg Body</cfmail>
---CF Admin Settings --------------------------------------------------------------
Server: smtp.xxx123.com
Port: 25
User: defined
Pwd: defined
TLS: Enabled
---Mail Log -------------(two different emails: both bad)--------------
"Error","scheduler-0","05/20/10","10:57:24",,"failed to connect"
"Error","scheduler-0","05/20/10","10:57:25",,"Could not connect to SMTP host: smtp.xxx123.com, port: 25"
----Exception Log ----------------------------------------------------------------
"Error","scheduler-2","05/19/10","14:03:22",,"failed to connect"
javax.mail.AuthenticationFailedException: failed to connect
at javax.mail.Service.connect(Service.java:322)
at coldfusion.mail.MailSpooler.getConnection(MailSpooler.java:1199)
at coldfusion.mail.MailSpooler.deliver(MailSpooler.java:984)
at coldfusion.mail.MailSpooler.sendMail(MailSpooler.java:905)
at coldfusion.mail.MailSpooler.deliverStandard(MailSpooler.java:1275)
at coldfusion.mail.MailSpooler.run(MailSpooler.java:1240)
at coldfusion.scheduling.ThreadPool.run(ThreadPool.java:201)
at coldfusion.scheduling.WorkerThread.run(WorkerThread.java:71)
----Wire Shark Transaction(s) --------------------------------------------------
---Good------------(Red is our CF server replying)------
220 RNR ESMTP
EHLO CFxxx-123250-smtp.xxx123.com Hello CFxxx-123. xxx123.edu [19.19.19.19], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-AUTH DIGEST-MD5
250-STARTTLS
250-DELIVERBY
250 HELP
STARTTLS
220 2.0.0 Ready to start TLS
---End Good---------------------------------------------------------------------------
---Bad--------- ---(Red is our CF server replying)---------------------------
220 RNR ESMTP
EHLO CFxxx-123
250-smtp.xxx123.com Hello CFxxx-123. xxx123.edu [19.19.19.19], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH DIGEST-MD5
250-STARTTLS
250-DELIVERBY
250 HELP
AUTH DIGEST-MD5
334

Answer 1

I'm not sure. That's why I asked. :) And I only ask because one of the settings made via
idsconfig is which "Authentication Methods" the DS will support. The choices being:
* none
* simple
* sasl/DIGEST-MD5
* tls:simple
* tls:sasl/DIGEST-MD5
When I set this DS up, I chose only tls:simple. A SunSolve document I read indicated that you
could have chosen more than one at that time, but I didn't. What I need to know is how to add support
for additional Authenticaion Methods after the fact. I assume there is a directory object somewhere and
its a matter of modifying or adding an attribute, but I wanted to make sure there were no gotchas
or caveats I should be aware of beforehand.