Why does a new installation ban addresses that send AUTH on port 25?

[RainbowWizard-coder]

I set up a fresh server and soon saw lines like Auto-ban: <address> is banned for 60 minutes after AUTH on a delivery port (port 25, ...) in the application log. One of them was a colleague whose phone was set to send on port 25 rather than 587.

What is this behaviour, and what should ports 25 and 587 be set to? I also have an older server that I upgraded: does it do the same, and should it?

[RainbowWizard-coder]

This is the per-listener SMTP authentication setting, added in 6.3.6 (work item 54). Port 25 is where other servers deliver mail; mail clients submit on 587. Port 25 is also the port every scanner on the internet reaches first, so it is the one a password spray goes to.

Each SMTP listener now says what it does with AUTH:

SMTP authentication	EHLO	What AUTH does
On	Offers AUTH	The password is checked, as it always was
Off	Does not offer AUTH	502 5.5.1 AUTH not permitted on this port. Nothing the client sent is evaluated. The first AUTH of a session bans the address
Honeypot	Offers AUTH exactly as On does	As Off. The offer is the bait

Off and Honeypot are not a password check that fails: a correct password is refused like any other, in the same time, so there is nothing to tell a real account from a made-up one.

The defaults

• A new installation: port 25 is Honeypot, port 587 is On.
• An upgrade: every existing listener stays On, so old clients that still sign in on 25 keep working. The setup checklist shows No password on port 25 (delivery_port_auth_on) until you change it.
• POP3 and IMAP listeners are always On.

For your colleague

1. Set the phone to send on 587 with STARTTLS.
2. Lift the ban: Control Panel, Sign-in & access > Auto-ban, Banned now, then Lift ban on the row. (The same ban is an expiring range on the IP ranges page.) Otherwise it ends on its own after the auto-ban duration, 60 minutes as shipped.

The ban itself

One IP range per address while it lasts, named Auto-ban: AUTH on a delivery port <address>, at priority 100, mirrored to the firewall only if you have AutoBanFirewall or AutoBanCommand set. It does not depend on the logon-failure auto-ban being on: the listener's setting arms it. Never banned, though still answered 502: this computer's loopback addresses, anything in AutoBanNeverBan (this is where you name an incoming relay that sends AUTH to port 25), an address the never-ban list by reverse name spares, and every address while the ban duration is 0. The session that earned the ban is not cut off; it carries on as inbound delivery.

For the upgraded server

Move your clients to 587 first, then set port 25 to Honeypot or Off:

• Control Panel: Connections & protocols > TCP/IP ports, the port's dialog, SMTP authentication. The ports list has a column for it.
• Control Deck: Ports, the port's editor (smtp_authentication).
• REST: PUT /api/v1/ports/{id} with smtp_authentication set to on, off or honeypot. PUT takes the whole port, so send back what GET /api/v1/ports returned with the one field changed.

Like every port property, it takes effect when the server is reinitialised. The checklist offers no one-click fix on purpose: changing it is what arms the ban, so it is your decision.

The older DisableAUTHList (Do not offer AUTH on these local TCP ports) still works on an On listener: no offer, 504, no ban.

More in SmtpAuthOnDeliveryPorts.md.