Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Within the last week, Comcast seems to have started blocking port 25 outbound from their residential internet service.

I can sort of understand why they might justify blocking it inbound as perhaps it is not within their terms of service to allow running a "server" on a residential service. I say sort of because I really don't agree with this, but whatever.

I run my own SMTP server on a hosted VPS for our business. Have done so for years. All of a sudden all of our SMTP connections from our home Comcast internet service started failing. I reconfigured the server to run SMTP on an alternate port and changed our client software at home to match and all is working again.

I suspect this is an anti-competitive measure in some respect and not merited on a technical or security basis. I imagine it would be quite a problem for someone who relied on a third party SMTP service on port 25.

Does everyone just run SMTP on an alternate port now? I know Gmail and Google's hosted email services do.

Is there any technical or security reason for Comcast to block outbound traffic on port 25 (or any outbound port really...)

share|improve this question
2  
It may be partly business reasons and partly a measure against zombie/compromised home computers being used by spammers –  james Feb 25 '13 at 17:21
2  
Yes, many mail servers use port 25 for server-server mail exchange, and port 587 (always authenticated) for message submission by clients. –  grawity Feb 26 '13 at 17:13
    
Thank you grawity, very illuminating comment. I was unaware of the IETF standards differentiating how port 25 should be used vs. 587 for server relay vs. client connections. –  Pat James Feb 26 '13 at 17:19

2 Answers 2

up vote 11 down vote accepted

They block outbound connections because of home computers turned zombies, as part of spammer-controlled botnets. They don't actually block all outbound connections to port 25; they just block all connections which do not target Comcast's own SMTP server. This is a way to force all emails to go through their own SMTP server, in which they may apply spam detection and filtering tools.

Gmail using "alternate ports" is not a deliberate workaround, but a byproduct of how SMTP-within-SSL was designed. There are two ways to get SSL/TLS protection on SMTP:

  1. The client connects then sends a STARTTLS command, and then both client and server "upgrade" the connection by doing a SSL handshake right away, on that connection.

  2. The client connects to the server and immediately begins the SSL handshake. This works because the server expects it, instead of "normal" SMTP commands; and that works because the server is bound on another port, namely 465.

share|improve this answer

I've seen colleges do this as well. It is generally an attempt to stop botnet zombies from generating SPAM messages as a massive amount of spam comes from zombie computers on residential IPs. Also, many legit mail servers either provide a secondary port or a secure port that you can connect to depending on the mail provider. I don't really think the reason is anti-competitive so much as security since it is generally easy enough to work around. (Granted, I'm not sure how effective it will be at it's goal since the zombies can simply be reprogrammed to use a different port as well.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.