To further emphasize the point that a mail server being authorized often isn't worth much, or can be counterproductive even: shocking numbers of SMTP providers

To further emphasize the point that a mail server being authorized often isn't worth much, or can be counterproductive even: shocking numbers of SMTP providers don't verify anything beyond the login. As a result, each and every one who manages to get an account can send legitimate looking messages for whatever domain allowing that host, e.g. another tenant. Microsoft and Google do perform sender address checks, as well as TransIP that I know of. Apart from them, though... For reference: in Postfix this can be configured with smtpd_sender_restrictions.