Re: ISP outbound SMTP filtering

If you're dialup/dsl/similar ISP, I recommend outright blocking of
SMTP with exception of those who have specifically informed you
that they need. I would also define need as someone who runs their
own mail server or needs to connect to outside mail server for
sending out email and that server does not offer submit (port 587).

Also before doing all this I'd first to do analysis of traffic on
your network (for a day or a week) to find which ips on your network 
actually make SMTP connections (outside of your network) and how often. 
That would help quite a bit in deciding if there are going to be issues 
with blocking SMTP. Besides that you may find quite easy to spot and 
whitelist those who do use SMTP legitimately and what you might want
to do is block all but those ips first, see who complaints and then
start dealing with these cases.

Also another option to just direct blocking is redirection to your
own mail server by default. You have to think if you really want
those extra connections and related issues or not ...

On Wed, 30 May 2007, Brian Johnson wrote:

>
> I have been contemplating our outbound filtering policy and am wondering
> what kind of outbound filters other regional/local ISPs are using.
> Currently
> we are looking at blocking outbound SMTP to curb botnet spamming
> systems,
> but would be interested in any "standard" filters that you are applying
> to
> prevent "bad traffic" from users.
>
> For those of you who have done this, does it work? What issues have you
> had?
> General comments.
>
> For those who don't do this, why? What reasons do you have for not doing
> this? General comments.
>
> TIA.
_______________________________________________
"Eat sushi frequently". - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list