I worked with Notes for 15 years, and your point C baffles me. Could you please elaborate?

I still remember the Notes/Domino Server TCP port number - 1352. I've used it so often in firewall configurations or communications with customers and firewall teams.

I had servers hosting data for replication to customers over the internet. (Including patent data, very sensitive in both security and timeliness). We never had any issues connecting servers over the internet. It was easy, reliable and simple.

It was also very secure due to the PKI infrastructure built into Notes, the ability to require encrypted network traffic, and the various layers of security on the server.

Plus the NRPC protocol has its own proxying feature, called "Passthru Servers". That allows clients or servers to connect to other servers via an intermediate server - and that intermediate can actually blacklist or whitelist other clients/servers from using it. It's all very easy to implement, a core part of the product that any Notes administrator should know about.

But what really confuses me is you talking about AD. You can do some integration with AD and Lotus Notes, but out of the box it uses its own directory and PKI infrastructure. That's famously one of the things people held against it - that it didn't use AD or NDS. If you did turn on the AD integration then I guess you'd need access to AD, but that's your decision - and the downsides of it are much the same for any local client software you're trying to authenticate via your AD.

I simply can't reconcile what you've said with my experience. So I'm very interested to understand what you're getting at there.