0

My current smtp server setup is like this:

Inbound emails:

Internet -> server1:25 (haraka1 smtp server) 
-> server1:2525 (haraka2 smtp server) -> server2:25 (Microsoft Exchange)

Outgoing emails:

server2:25 (Microsoft Exchange) -> ISP's SMTP server (smarthost in microsoft language)

Now I would like to add a middle smtp server for outgoing emails too:

server2:25 (Microsoft Exchange) -> server1:25259 (haraka smtp server) 
-> ISP's SMTP server

My question is, will it cause any problem for using a nonstandard port (25259), for outgoing emails?

From exchange point of view the haraka smtp server (server1:25259) is a smarthost.

I want to achieve the following things with this new setup:

  1. I can sign all outgoing emails with DKIM
  2. I can send part of the emails through my ISP's smtp server (normal email traffic), and through sendgrid (transactional emails)
  3. rate limiting, and spam sending prevention (ie. 200emails/day maximum per user, except haraka receives a special email)

Sidenote:

Sending emails from a client is like this:

client (from the internet) -> server1:587 (haraka3) -> server2:25 (Exchange)

client (within the same lan) -> server:25 (Exchange)

I was forced to put haraka smtp servers in front of Exchange servers, because lately I got many brute force attacks from the internet (about 20.000/day smtp auth tries). And haraka is really simple to modify for my needs (ssl enforcing, rate limit, ehlo checking, etc, etc).

The above email system is rather small, I have about 50 users and about 100-500 email/day outgoing traffic.

1

Exchange doesn't care what port you send email out on. As long as there is something else on the other end to receive the email. You can only use a non-standard port with a smart host - as the rest of the internet uses port 25. Your scenario is quite common.

Authentication attacks on Exchange is pretty common. Having authenticated relay on port 25 is the issue here. If you must use SMTP rather than Outlook Anywhere, then route it over TLS and use 465. Leave port 25 as anonymous only for inbound email.

| improve this answer | |
  • From the internet I do not enable outgoing email from port 25, it is for inbound only (for outgoing there is a dedicated haraka smtp server on server1:port587). Just like what you suggest. – user12933 Dec 14 '16 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.