diff --git a/mailhog/smtp/protocol/protocol.go b/mailhog/smtp/protocol/protocol.go
index 46005ee..980c8ce 100644
--- a/mailhog/smtp/protocol/protocol.go
+++ b/mailhog/smtp/protocol/protocol.go
@@ -23,10 +23,11 @@ type Protocol struct {
 	message  *data.SMTPMessage
 	hostname string
 
-	LogHandler               func(message string, args ...interface{})
-	MessageReceivedHandler   func(*data.Message) (string, error)
-	ValidateSenderHandler    func(from string) bool
-	ValidateRecipientHandler func(to string) bool
+	LogHandler                    func(message string, args ...interface{})
+	MessageReceivedHandler        func(*data.Message) (string, error)
+	ValidateSenderHandler         func(from string) bool
+	ValidateRecipientHandler      func(to string) bool
+	ValidateAuthenticationHandler func(mechanism string, args ...string) bool
 }
 
 // NewProtocol returns a new SMTP state machine in INVALID state
@@ -182,6 +183,11 @@ func (proto *Protocol) Command(command *Command) (reply *Reply) {
 				return ReplyAuthResponse("PDQxOTI5NDIzNDEuMTI4Mjg0NzJAc291cmNlZm91ci5hbmRyZXcuY211LmVkdT4=")
 			case strings.HasPrefix(command.args, "EXTERNAL "):
 				proto.logf("Got EXTERNAL authentication: %s", strings.TrimPrefix(command.args, "EXTERNAL "))
+				if proto.ValidateAuthenticationHandler != nil {
+					if !proto.ValidateAuthenticationHandler("EXTERNAL", command.args) {
+						// TODO error reply
+					}
+				}
 				return ReplyAuthOk()
 			default:
 				return ReplyUnsupportedAuth()
diff --git a/mailhog/smtp/server/session.go b/mailhog/smtp/server/session.go
index 202ae24..72e49c0 100644
--- a/mailhog/smtp/server/session.go
+++ b/mailhog/smtp/server/session.go
@@ -28,9 +28,10 @@ func Accept(conn *net.TCPConn, conf *config.Config) {
 	proto := protocol.NewProtocol()
 	session := &Session{conn, proto, conf, false, ""}
 	proto.LogHandler = session.logf
-	proto.MessageReceivedHandler = session.acceptMessageHandler
+	proto.MessageReceivedHandler = session.acceptMessage
 	proto.ValidateSenderHandler = session.validateSender
 	proto.ValidateRecipientHandler = session.validateRecipient
+	proto.ValidateAuthenticationHandler = session.validateAuthentication
 
 	session.logf("Starting session")
 	session.Write(proto.Start(conf.Hostname))
@@ -39,6 +40,9 @@ func Accept(conn *net.TCPConn, conf *config.Config) {
 	session.logf("Session ended")
 }
 
+func (c *Session) validateAuthentication(mechanism string, args ...string) bool {
+	return true
+}
 func (c *Session) validateRecipient(to string) bool {
 	return true
 }
@@ -47,7 +51,7 @@ func (c *Session) validateSender(from string) bool {
 	return true
 }
 
-func (c *Session) acceptMessageHandler(msg *data.Message) (id string, err error) {
+func (c *Session) acceptMessage(msg *data.Message) (id string, err error) {
 	switch c.conf.Storage.(type) {
 	case *storage.MongoDB:
 		c.logf("Storing message using MongoDB")