Encryption and authentication on private network mail relay?

[paul]

Hello!

I have questions that maybe are outside the direct scope of OpenSMTPD, 
but I am working to configure OpenSMTPD with the answers to these 
questions.

If anyone is willing to respond directly or even recommend some 
excellent reading material to answer the following questions, I would 
greatly appreciate it, as my searches have been unfulfilling.

In my relatively limited experience in configuring mail servers and 
servers in general, I have never configured a small network/pool of 
servers as I am doing right now. The "pool" is on a hosted VPS provider 
that offers a private network which has only my servers on the private 
network.

I am configuring one server to be the "SMTP server" that will handle 
outgoing mail and no servers in the pool will handle incoming mail (not 
even the SMTP server). Services in the pool will use the SMTP server for 
sending transactional mail and newsletters. Most of the servers are 
running OpenBSD and each will be configured to use the local OpenSMTPD 
for connecting to the relay (except one Linux server will use Postfix).

Authentication? The local network only includes servers in the same data 
center. Presumably, the local network cannot be accessed from outside 
the network controlled by the ISP. I'm already trusting the ISP with the 
servers - is it still a bad idea to run an open relay on a private 
network, even if I configure pf to only accept connections from the 
approved private network servers?

Encryption? What is the case for encrypting data traversing the private 
network? I don't find good answers on this, even in general networking 
type considerations.

I know these seem like basic questions and I'm probably skilled enough 
to just cobble together a config that works and keep going, but I just 
wanted to see if I could find some answers to these questions so I could 
have a better understanding of my configurations.

Thank you!


Paul