Recommended MTA for Windows Server

Howewer you configure it, Exchange is not going to route a message outside the organization if the destination address belongs to someone in Active Directory. Whenever Exchange needs to route a message, the first step it tries is always to look for the destination address in AD, and only after this fails it will choose a proper external routing path, based on the connectors you define.

With Exchange 2007 you can have "shared" SMTP domains, i.e. domains for which some addresses may be managed by Exchange, and some other by another system (in a coexistence scenario); I don't know if/how this is possible with 2003, but even if it was, the above stated golden rule still applies: first thing first, Exchange will try to deliver the message internally, and only if it can't, it will send the message outbound.

Think about it: if there was a way to do what you ask, what would Exchange do when receiving a message for a given user (even if it was already being forwarded by your provider)? It would route it back to your provider. There is no way to route messages based on who sends them, only on their destination; and the destination would be the same when the message is coming from Exchange itself, or when is coming from outside: if your wish could come true, you'd be stuck in a mail loop.

Your example is not sufficient to show that plaintext auth isn't allowed over non-tls connections. --protocol SMTP is explicitly telling swaks NOT to use ESMTP, and ESMTP is required for authentication. In other words, you're testing that auth isn't offered over SMTP, not that plaintext auth isn't offered over plaintext connections. (who's on first!).

The following is closer to what you're looking for:

# These should fail, because you don't want to offer plaintext auth protocols
# over non-tls connections
swaks ... --auth PLAIN --auth-user .. --auth-password ..
swaks ... --auth LOGIN --auth-user .. --auth-password ..

# Should succeed because hashed PW protocols are ok over plaintext (assuming you
# support them at all of course):
swaks ... --auth CRAM-MD5 --auth-user .. --auth-password ..
swaks ... --auth DIGEST-MD5 --auth-user .. --auth-password ..
swaks ... --auth NTLM --auth-user .. --auth-password ..

# The converse of the above, make sure your plaintext password work over tls
# sessions (assuming you want them to, of course)
swaks ... --auth PLAIN --auth-user .. --auth-password .. --tls
swaks ... --auth LOGIN --auth-user .. --auth-password .. --tls
swaks ... --auth CRAM-MD5 --auth-user .. --auth-password .. --tls
swaks ... --auth DIGEST-MD5 --auth-user .. --auth-password .. --tls
swaks ... --auth NTLM --auth-user .. --auth-password .. --tls

Hope that helps, good luck!