Restricting connections to your mail servers

We strongly recommend that you prevent servers on the Internet from sending email directly to your mail servers, ignoring your MX records. If this is not prevented then email can be maliciously routed directly to your mail servers, bypassing Forcepoint Email Security Cloud. You may be able to do this at your corporate firewall or on your Internet mail gateway by restricting incoming SMTP traffic from any source other than Forcepoint Email Security Cloud. We recommend that you block all SMTP traffic except that from all IP address ranges that Forcepoint Email Security Cloud uses. These can be found on the Email > Settings > Service IP addresses page in the cloud portal.

In addition, you should enforce outbound mail routing to be via Forcepoint Email Security Cloud to ensure that it is analyzed for viruses and other security issues.

As a general security measure, we also recommend restricting the use of external Web mail systems such as Hotmail, because they offer another possible avenue for virus infection. Where possible, you should also block IMAP and POP3 access from your network to external mail servers. Email arriving from such servers has not been processed by Forcepoint Email Security Cloud.