<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 12pt; font-family: Arial,Helvetica,sans-serif'>
<p>Full-Quote of Guillaume's mail see below (mail was sent directly and didn't go to the list).</p>
<p><br /></p>
<p>My Opinion about this: Yes, you have to use dedicated submission-ports, that's how it is defined to work. Misusing port 25 is a wideseen configuration, but that's not how it was designed in the RFC's. You say popular IT-Networks don't allow outgoing connections to the dedicated submission-ports but allow outgoing connections to port 25? That's weird. My personal experience when traveling and using Public/Hotel/Airport/University/Company-WLANs is, that port 25 is almost everywhere blocked (to prevent outgoing spam from these LANs) but using submission-ports usually works fine.</p>
<p>If you really have this problem feel free to configure your personal client to use Port 25 or host an additional submission port on 443 to go through these firewalls.</p>
<p><br /></p>
<p><br /></p>
<p>Am 2016-10-14 13:34, schrieb Guillaume REMBERT:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">OK. I got it! This is driven by the master.cf config with -o<br /> smtpd_tls_security_level=encrypt.<br /><br /> Thanks a lot for your feedbacks and for correcting me.<br /><br /> One last question/remark to fully understand this topic and config.<br /><br /> TLS is under the application layer SMTP. In my original setup,<br /> port 25 is used for both reception of Mail (MTA) and submission (MSA).<br /> How can be done the differenciation between a reception connexion and a<br /> submission connexion? It is not possible as TLS is done before any<br /> application exchange. So I need also to open a dedicated port reserved<br /> for submission as recommended in the doc - TCP/587?<br /><br /> One problem that I see there is that most IT networks don't allow<br /> output traffic to port 587, thus it is not possible to directly send<br /> mail in most foreign corporate networks - example here-after of an<br /> access provided by a big european organisation:<br /> - HTTP TCP / 80<br /> - HTTPS TCP / 443<br /> - SMTP* TCP / 25<br /> - POP3 TCP / 110<br /> - POP3s TCP / 995<br /> - IMAP TCP / 143<br /> - IMAPs TCP / 993<br /> - IPSEC UDP / 500<br /> - IPSEC UDP / 4500<br /> - OpenVPN UDP / 1194<br /><br /> In that case I would have to establish a VPN in order to send my mail.<br /><br /> What would be your position related to this strong limitation?<br /><br /></div>
</blockquote>
</body></html>