Forcing TLS on incoming MTA connections

Question

I've seen this question of a user that cannot receive emails over port 25.

Is there a way to force/redirect external MTA connections to use TLS port 587 instead of port 25?

Answer 1

Is there a way to force/redirect external MTA connections to use TLS port 587 instead of port 25?

If you mean something akin to redirecting from port 80 to port 443, then I don't believe there is any similar, standardized switching mechanism like that for email.

That said, even if there was, whoever was controlling port 25 would likely be responsible for implementing that redirection. Regarding the linked question, Comcast has the final word on how they treat incoming connections (if blocked, the connection itself would never reach the mail server at issue).

Note, however, there are services that will accept email on port 25 on your behalf and redirect it. You list their mail servers in your MX records and they then automatically pass any appropriate external email received on to you on an alternate, unblocked port (which could be port 587). Using such a third party would resolve the issue in the linked question.

---

Port 587

While port 587 isn't blocked by Comcast (either for incoming or outgoing email), port 587 is specifically meant to be used for the submission of outgoing email by email clients (Mail User Agents or MUAs). Communications between mail servers (MSA to MTA or MTA to MTA) typically takes place on port 25. The diagram below shows a potential exception to that rule which could be applicable to the linked question (but it still pertains to outgoing email).

Exceptions aside, to be clear, what this means is that anyone who connects directly to port 587 through Comcast could deliver email to a mail server listening on that port... but, in general, most people would never do that (aside from possibly the original asker themselves).