Firewall – Is it Safe to Unblock SMTP Submission Port 587?

We use the following rules in acl_check_rcpt, but I suspect they would work better in acl_check_helo

deny
   condition      = ${if and{{eq{$interface_port}{587}} {eq{$tls_cipher}{}} } }
   message        = All port 587 connections must use TLS

deny condition    = ${if eq{$interface_port}{587}}
   !authenticated = *
   message        = All port 587 connections must be Authenticated

Obviously you only want the second of the two rules, but the first shows how to reject non-TLS connections. You may want to think about disallowing plaintext authentication methods if you aren't going to enforce TLS.

Normally ports 465 and 587 require user authentication prior to accepting emails - if this is the case, then you don't need to block these ports (from the purpose of being an open relay), as only users who are authenticated against your system can use them. That said, if you are not opening your system to incoming users, blocking them is a good idea (less access=less security risks).

Generally a secure firewall should be built "default deny", and I suggest thats what you do here if you can. You don't need 587 or 465 in order to receive email from other users.

Lastly, assuming your system is not an open relay, your system will most likely send spam if a users account (or a website using the mail server) is compromised. Tightening up the mail server won't help this behaviour - its a matter of educating users and locking down what can send email.

If you need a fallback, you can always attempt to run filters on outgoing mail or farm this task out to a third party provider - but this may well be overkill for your needs.