The components and the flow.
WHAT THE COMPONENTS ARE
A submission service, accepting mail from authenticated users A transfer agent, delivering between servers A delivery agent, placing mail into storage An access service, letting users read it Filtering, at several points
WHAT THE FLOW IS
A client submits to your server, authenticated Your server looks up the recipient domain's mail records It connects to the recipient's server and delivers The recipient's server accepts, rejects or defers The recipient reads it through an access service
WHAT DEFERRAL MEANS
A temporary failure, with the sender expected to retry.
WHY THAT MATTERS
Greylisting deliberately defers unknown senders, since much unwanted mail never retries.
WHAT THE SEPARATE PORTS ARE FOR
One for server-to-server transfer One for authenticated submission One for authenticated submission over an encrypted connection from the start
WHAT TO NEVER DO
Accept unauthenticated mail for arbitrary destinations.
WHAT THAT IS
An open relay, which is found and abused within hours.
WHAT TO SEPARATE
Submission from transfer, with different policies on each.
