Why it is so widely tolerated to allow SMTP server in DMZ to initiate connection to the LAN

Question

I was surprised to see that the French cybersecurity agency tolerates an SMTP relay server in the DMZ (which collects emails received from the Internet) to reach the Email server in the LAN.

In my opinion, the relay SMTP server in the DMZ should keep the ongoing emails in memory until the LAN Mail server ask it "hey do you have new emails ?" (like every 10 seconds).
So the connection is initiated from the LAN to the DMZ. The SMTP server in the DMZ only answers to the LAN server.

I read some topics here and found that this is commonly admitted as a tolerable exception of the "no DMZ to LAN flow".

I understand that only ONE stream, from DMZ to ONE asset in the LAN on ONE TCP port only is a low risk. But why not just avoid it and make the internal mail server regularly pull incoming emails from the DMZ relay instead of having the DMZ relay pushing in the LAN?

Answer 1

SMTP is a push protocol, not a pull protocol. So to do what you describe, you'd have to abandon SMTP and make the DMZ host a mail server serving mail user agents (like POP/IMAP) which have bigger security holes than SMTP.

The idea here is that known SMTP exploits (ignoring phishing) are not from malformed emails, but from exploiting bugs in the SMTP server itself, and email parsing is simple enough there shouldn't be an exploit there. So once the email passes through the smtp server, it is safe for that server to forward it to an internal server.

Also, you can use the DMZ email server as a filter, and try to block spam and phishing and bad attachments right there so they might not even make it into an internal SMTP server.

The SMTP server in the DMZ acts as a similar purpose as a filtering firewall, but just for mail traffic.