N10-009 Question 57
Single answerSMTP: 25A company hosts its own email server in the data center and recently changed its edge firewall rules. After the change, internal users can still send email through the mail server and access web services normally, but customers on the internet report that messages sent to the company are being returned as undeliverable. The administrator verifies that the public MX record still points to the correct public IP address. Which firewall rule should the administrator check first to restore inbound email delivery?
- A
Allow inbound TCP port 25 from the internet to the mail server
- B
Allow inbound TCP port 110 from the internet to the mail server
- C
Allow outbound UDP port 53 from the mail server to the internet
- D
Allow inbound TCP port 443 from the internet to the mail server
Show answer and explanation
Correct answer: A
Explanation
When an organization hosts its own mail server, external mail systems deliver messages to it using SMTP over TCP port 25. In this scenario, internal sending still works and the MX record is confirmed as correct, which strongly suggests the issue is with inbound connectivity to the mail service rather than DNS resolution or client access protocols. Best practice troubleshooting is to verify the MX record, confirm the public IP/NAT mapping, and then test reachability to TCP 25 from an external network. Port 25 is specifically associated with SMTP message transfer between mail servers, while ports such as 110 (POP3) and 443 (HTTPS) serve different functions. This aligns with standard IANA port assignments and common email infrastructure design.
- A. Correct.
Correct. SMTP server-to-server email delivery uses TCP port 25. If external senders cannot deliver mail to the company's hosted email server, one of the first things to verify is that the firewall allows inbound TCP 25 to the internal mail server or its published address. This is the standard port used for receiving mail from other mail servers.
- B. Incorrect.
Incorrect. TCP port 110 is POP3, which is used by clients to retrieve email from a mailbox server. Blocking or allowing POP3 would affect users downloading mail, not other organizations' mail servers delivering inbound messages to the company's server.
- C. Incorrect.
Incorrect. UDP port 53 is DNS. DNS is important for MX record lookups, but the scenario already states that the MX record points to the correct public IP. Also, while DNS issues can affect mail flow, the most direct firewall rule related to SMTP delivery itself is inbound TCP 25, not outbound UDP 53.
- D. Incorrect.
Incorrect. TCP port 443 is HTTPS, used for secure web traffic such as webmail or administrative portals. Allowing HTTPS would not restore SMTP mail delivery from external mail servers.