Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a newbie security related question.

Should port 25 (smtp) be blocked by firewall on my server? Or will doing so mean that i cannot send any mail at all?

Maxwell: I basically have my own mail server. It is used by the website, on the same server, to send mails. I also need to be able to send/receive mails using a pop client. In that case which of your options should i adapt?

share|improve this question

If you intend to just send and not receive mail from this server, just block incommming connections on port 25 on the server firewall.

If you're hosting your own mail server you need to accept at the network firewall the trafic to and from port 25 at destination of your corporate mail server.

If you do not host your own mail server, at the network firewall you just have to allow outgoing connections on port 25.

If you need a more concise answer, please edit your question and add some more informations.

Hope this helps.

share|improve this answer
You own mail should be submitted via MSP on port 587, and you should be able to completely block port 25 (unless you run a mail server). Unfortunately many ISPs don't support MSP, YMMV. – Chris S Jun 10 '10 at 13:17

Assuming you have you own mail server, then what you should do is block all outgoing "port 25" packets at the firewall except from your mail server. This is (or should be) standard practice for all networks. The reason for this is if any of your systems get infected with a spam virus, then even if they start spewing spam, it won't reach the outside world, and you won't end up with your domain on all the spam blacklists. (I'm speaking from bitter experience here).

As well, you can block all SMTP packets coming in from outside except those destined for your mail server.

You may also want to screw down other packets - for example, if you have everyone on the network going through a proxy server for internet access (to implement web filtering, for example), then use the firewall to block outgoing http packets from all sources except the proxy server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.