diff --git a/docs/test_infra/test_infra_smtp.md b/docs/test_infra/test_infra_smtp.md
index 76f72d4..a9dceab 100644
--- a/docs/test_infra/test_infra_smtp.md
+++ b/docs/test_infra/test_infra_smtp.md
@@ -29,18 +29,30 @@ For `appsettings.Development.json` (Notification Service):
   "Smtp": {
     "Server": "localhost",
     "Port": 1025,
-    "AuthMode": "None",
+    "AuthMode": "Basic",
+    "Credentials": "test:test",
+    "TlsMode": "None",
     "FromAddress": "scada-notifications@company.com",
     "ConnectionTimeout": 30
   }
 }
 ```
 
-Since `MP_SMTP_AUTH_ACCEPT_ANY` is enabled, the Notification Service can use any auth mode:
-- **No auth**: Connect directly, no credentials needed.
-- **Basic Auth**: Any username/password will be accepted (useful for testing the auth code path without a real server).
+> **`Server` host**: use `localhost` only when the Notification Service runs directly on
+> the host. When it runs inside the docker cluster, set `Server` to the container name
+> `scadalink-smtp` — the cluster compose stack and the infra compose stack share the
+> `scadalink-net` network, so the container is reachable by name.
+
+The delivery service (`MailKitSmtpClientWrapper`) only accepts `Basic` or `OAuth2` —
+there is no "no auth" mode — so the working config above uses `Basic`:
+- **Basic Auth**: `MP_SMTP_AUTH_ACCEPT_ANY` makes Mailpit accept any `username:password`,
+  so use a throwaway value such as `test:test`. This exercises the real auth code path
+  without a real server.
 - **OAuth2**: Not supported by Mailpit. For OAuth2 testing, use a real Microsoft 365 tenant.
 
+`TlsMode` **must** be `None`: Mailpit on port 1025 is plain SMTP and does not offer
+STARTTLS. `StartTLS` or `SSL` would fail the connection.
+
 ## Mailpit API
 
 Mailpit exposes a REST API at `http://localhost:8025/api` for programmatic access: