Policy on control of incoming email

Policies applying to the mail relay service and the treatment of incoming email with regards to minimising the potential of damage to the university's reputation from the promulgation of spam and viruses.

The following policy on the control of incoming email was agreed by the then Communications and Information Technology Committee (C&IT) in February 2004.

Control of incoming email

In order to prevent the relaying of mail, typically spam, between third parties via machines on our network, and for other more general security reasons, IP packets entering the network for port 25 (email listener) will be blocked unless they are made to a small number of designated IP addresses representing known secure mail servers.

Such relaying results in complaints, damage to the reputation of the university, and possible disruption of legitimate mail service by blacklisting.

The purpose is not to prevent schools or units running their own independent mail services. If they choose to do so, and the services they run are secure and actively maintained, then it is not in EUCS's brief to prevent them from doing so. EUCS will establish which mail services exist, liaise with schools about their status and whether they require direct incoming email, then and thus prevent any email getting to servers which have been inadvertently set up.

The underlying security principles for email servers will be:

1. All mail passing through the university network should be scanned for viruses and, where dangerous content is detected, messages should be rejected, discarded, or otherwise dealt with, as appropriate.
2. No unnecessary mail services should be run on the university network.
3. In any case, the number of mail services exposed to the Internet should be minimised.

This policy was last updated 6/7/2005.