Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I secure my SMTP port from being telnetted by external IPs?

share|improve this question
What MTA are you running? Do you want to be able to use it to recieve mail? – andol Dec 12 '09 at 14:51
I dunno much about email servers. It's setup to use Exchange 2007 – gAMBOOKa Dec 12 '09 at 14:57
up vote 4 down vote accepted

What are you trying to do? How do you equate "not being 'telnetted'" (whatever that means) with securing a server? You need to allow access to your SMTP port in order for other SMTP servers to connect and deliver mail, so either you need to re-think what you're trying to do, or the best way to secure this exchange server in the way you're asking is to go to add and remove programs and uninstall it.

You can of course take a few steps to protect your mail server if you only have one and you're worried about it. The "classic" Microsoft way would be to deploy another Exchange server as an "edge" server. You can of course do something similar with lots of opensource mail servers as the "edge" if you put some work into it, or even outsource your "edge" to companies such as messagelabs and mimecast and lock your mail server down to only accept messages from their servers. Not cheap but quite effective that last one.

As things stand though, if you want that server to receive email directly from the internet then you have to allow connections to it on port 25(and accept that some connections will be made using telnet, and that this shouldn't be a problem if your server is otherwise secure and if your server is not otherwise secure then blocking telnet apps somehow still isn't securing the machine). That's the price you pay for running a server connected to the Internet.

share|improve this answer

If you mean that you want to prevent someone from telnetting to port 25 and issuing SMTP commands, then you can't. SMTP is basically just a network connection to port 25 with commands and data, so anything capable of replicating that can do the same thing as a mail client. Trying to prevent it means breaking the way SMTP is designed to work.

Additional info: from the title of your question it seems as though you may have fallen prey to some of the paranoid hyperbole that occasionally circulates about security. Never forget that security is as much about letting the good guys in as it is about keeping the bad guys out, and the reason why security is hard is on account of the need to get the correct balance between the two. In the case of SMTP, connecting over port 25 is the method used by external email servers to send email to your server, so it definitely falls under the heading of "letting the good guys in".

If you have a more specific problem that is prompting you to ask this question then I'll give my usual mantra of "focus on what you want to achieve rather than how you want to achieve it", and request more info on what that specific problem is.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.