diff --git a/common/email_ntlm_auth.go b/common/email_ntlm_auth.go
index 59e2d40c..98a55a6b 100644
--- a/common/email_ntlm_auth.go
+++ b/common/email_ntlm_auth.go
@@ -31,7 +31,7 @@ func (a *smtpAutoAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
 	switch {
 	case smtpServerSupportsAuth(server, "PLAIN"):
 		a.mech = "PLAIN"
-		return "PLAIN", []byte("\x00" + a.username + "\x00" + a.password), nil
+		return smtp.PlainAuth("", a.username, a.password, SMTPServer).Start(server)
 	case smtpServerSupportsAuth(server, "LOGIN"):
 		a.mech = "LOGIN"
 		return "LOGIN", []byte{}, nil
@@ -44,7 +44,7 @@ func (a *smtpAutoAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
 		return "NTLM", negotiateMessage, nil
 	default:
 		a.mech = "PLAIN"
-		return "PLAIN", []byte("\x00" + a.username + "\x00" + a.password), nil
+		return smtp.PlainAuth("", a.username, a.password, SMTPServer).Start(server)
 	}
 }
 
diff --git a/common/email_test.go b/common/email_test.go
index 01c01cdd..47916fdf 100644
--- a/common/email_test.go
+++ b/common/email_test.go
@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"math/big"
 	"net"
+	"net/smtp"
 	"strconv"
 	"strings"
 	"testing"
@@ -348,6 +349,37 @@ func TestSendEmailDoesNotAutoUpgradeWhenStartTLSDisabled(t *testing.T) {
 	}
 }
 
+func TestSMTPPlainAuthRejectsRemotePlaintextConnection(t *testing.T) {
+	server := newFakeSMTPServerWithSTARTTLSAdvertisement(t, false)
+	defer server.close()
+	withSMTPSettings(t)
+
+	SMTPServer = "smtp.example.com"
+	SMTPPort = server.port
+	SMTPSSLEnabled = false
+	SMTPStartTLSEnabled = false
+	SMTPInsecureSkipVerify = false
+	SMTPForceAuthLogin = false
+	SMTPAccount = "sender@example.com"
+	SMTPFrom = "sender@example.com"
+	SMTPToken = "secret"
+
+	conn, err := net.Dial("tcp", fmt.Sprintf("%s:%d", server.host, server.port))
+	require.NoError(t, err)
+	client, err := smtp.NewClient(conn, SMTPServer)
+	require.NoError(t, err)
+
+	err = client.Auth(getSMTPAuth())
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "unencrypted connection")
+
+	select {
+	case command := <-server.authCommands:
+		t.Fatalf("unexpected SMTP auth command: %s", command)
+	default:
+	}
+}
+
 func TestNewSMTPClientHonorsExplicitStartTLSWhenPortIs465(t *testing.T) {
 	server := newFakeSMTPServer(t)
 	defer server.close()