SMTP mail handling in PNS is very flexible and is designed to allow for as many different e-mail “needs” as possible. Based on the size, profile and security requirements of a company, there are a number of configurations possible for handling email traffic.

Very small companies trust their ISP to host SMTP service for them and only connect with a mail retrieval (post office) protocol (POP3 or IMAP) to download the mail and use the ISP's mail server as their outgoing SMTP server. Larger companies may have their own SMTP server but still use the ISP's mail server as their official mail exchanger and only relay mail between the two. Companies needing maximal protection have a fully functional, DNS-registered mailserver. The next level is companies with a sophisticated mail routing architecture, multiple domains and complex email traffic rules.

PNS aims to provide protection support for all types of SMTP requirements. It has a proxy class for SMTP that is the primary tool for handling SMTP traffic. It is not a fully functional mail server but a fully transparent filter module rather. It does not send and receive SMTP mail messages and it does not have a local mail store either. This proxy can interoperate with antivirus software for filtering viruses in SMTP traffic. With the SmtpProxy or a customized, derived version of it most SMTP firewalling needs can be fulfilled.

There are, however, cases when simply proxying SMTP traffic is not enough and some more intelligent mail handling procedure is required due to the organization's special needs.

For such cases PNS installs a fully functional Postfix service besides the SmtpProxy. Because it is fully functional, virtually any setups and configurations possible with a Postfix mail server are also possible here. It does not mean that PNS should be operated as a generic mail server for users, only that sophisticated SMTP configurations are possible with it.

Another use of the Postfix component is to provide SMTP delivery service for local services, like syslog-ng and others that need be able to send mail. Local delivery of e-mail, however, should not be allowed, if possible.

Even if the configuration options of SmtpProxy are not adequate, it is still recommended to be the SMTP mail handling 'front-end' at the firewall which, after proxy-level filtering, passes SMTP traffic to the Postfix service.

Because possible uses of the Postfix component are so versatile, it is impossible to cover even the most typical ones in this chapter. Nor is it a firewall administrator's task to set up a complex mail routing architecture, therefore only a brief introduction of the configuration interface is presented. For more information and details on Postfix, see Appendix C, Further readings.