Subject: [Asrg] 7.b. Mail administrators

From: Hein Roehrig <[email-masked]>
Date: Fri, 12 Sep 2003 22:44:58 +0200

I have a question about best practices regarding egress filtering on
organizational networks.

Port 25 makes sense to prevent "owned" machines from being used as
relays.

What about the other ports? I would be particularly curious about BCP
for ports 465 (ssmtp, SSL-wrapped SMTP) and 587 (submission, often
used for plain-text SMTP with an immediate STARTTLS required).

Can a case be made for spam reduction by blocking the ports for
outgoing connections? Are there many systems around that accept
incoming mail on these ports?

Of course, in an open environment there are significant advantages to
leave those ports open for roaming users and guests to connect to
their "home" mail servers for outgoing mail.

TIA,
Hein

-- 
http://hein.roehrig.name

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Fri, 12 Sep 2003 23:12:17 +0200

>  incoming mail on these ports?

	I believe that this is something that should definitely be 
addressed in a BCP.  However, I do not know if this is something that 
is already covered by an existing BCP -- I'll have to do some 
searching.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)