3.1.5.1 Initiating the "GSSAPI" Mechanism

When the SMTP AUTH Extension [RFC2554] determines to use the "GSSAPI" SASL mechanism, the client MUST then associate the SPNEGO Extension [MS-SPNG] GSS-API mechanism with the connection. The way the client determines which of the SASL mechanisms to use is implementation-specific, but the client SHOULD use the SPNEGO Extension only if "GSSAPI" is returned in the list of SASL mechanisms in the EHLO exchange specified in [RFC2554] and SHOULD prefer the SPNEGO Extension over any other such SASL mechanisms supported.

As a result of the client associating the SPNEGO Extension with the connection, the rest of the exchange will proceed as specified in [RFC2554] for AUTH command processing, in [RFC2222] for mapping the SASL mechanism to specific GSS-API function calls, and in [MS-SPNG] for the behavior of those GSS-API function calls.