What justification is there for Comcast to block SMTP port 25 outbound from residential service?

Question

Within the last week, Comcast seems to have started blocking port 25 outbound from their residential internet service.

I can sort of understand why they might justify blocking it inbound as perhaps it is not within their terms of service to allow running a "server" on a residential service. I say sort of because I really don't agree with this, but whatever.

I run my own SMTP server on a hosted VPS for our business. Have done so for years. All of a sudden all of our SMTP connections from our home Comcast internet service started failing. I reconfigured the server to run SMTP on an alternate port and changed our client software at home to match and all is working again.

I suspect this is an anti-competitive measure in some respect and not merited on a technical or security basis. I imagine it would be quite a problem for someone who relied on a third party SMTP service on port 25.

Does everyone just run SMTP on an alternate port now? I know Gmail and Google's hosted email services do.

Is there any technical or security reason for Comcast to block outbound traffic on port 25 (or any outbound port really...)

Answer 1

They block outbound connections because of home computers turned zombies, as part of spammer-controlled botnets. They don't actually block all outbound connections to port 25; they just block all connections which do not target Comcast's own SMTP server. This is a way to force all emails to go through their own SMTP server, in which they may apply spam detection and filtering tools.

Gmail using "alternate ports" is not a deliberate workaround, but a byproduct of how SMTP-within-SSL was designed. There are two ways to get SSL/TLS protection on SMTP:

1. The client connects then sends a STARTTLS command, and then both client and server "upgrade" the connection by doing a SSL handshake right away, on that connection.

2. The client connects to the server and immediately begins the SSL handshake. This works because the server expects it, instead of "normal" SMTP commands; and that works because the server is bound on another port, namely 465.

Answer 2

I've seen colleges do this as well. It is generally an attempt to stop botnet zombies from generating SPAM messages as a massive amount of spam comes from zombie computers on residential IPs. Also, many legit mail servers either provide a secondary port or a secure port that you can connect to depending on the mail provider. I don't really think the reason is anti-competitive so much as security since it is generally easy enough to work around. (Granted, I'm not sure how effective it will be at it's goal since the zombies can simply be reprogrammed to use a different port as well.)