I was surprised to see that the French cybersecurity agency tolerates an SMTP relay server in the DMZ (which collects emails received from the Internet) to reach the Email server in the LAN.
In my opinion, the relay SMTP server in the DMZ should keep the ongoing emails in memory until the LAN Mail server ask it "hey do you have new emails ?" (like every 10 seconds).
So the connection is initiated from the LAN to the DMZ. The SMTP server in the DMZ only answers to the LAN server.
I read some topics here and found that this is commonly admitted as a tolerable exception of the "no DMZ to LAN flow".
I understand that only ONE stream, from DMZ to ONE asset in the LAN on ONE TCP port only is a low risk. But why not just avoid it and make the internal mail server regularly pull incoming emails from the DMZ relay instead of having the DMZ relay pushing in the LAN?