b.1 SMTP Send (Tests 8/14/18): required port, and is a transparent TCP relay allowed when outbound 25 is blocked?
Prince Boothe
We're preparing §170.315(b)(1) Direct certification and have implemented the SMTP + IMAP edge (Send using Edge Protocol – SMTP).
Our constraint: our application is hosted on a major cloud platform that — like AWS, Google Cloud, and Azure — blocks outbound TCP port 25 at the platform level as a standard anti-abuse measure, and this block cannot be lifted on our account type. We confirmed it empirically: even a dedicated VM with its own public IP cannot open an outbound connection on port 25, while port 143 (IMAP receive) connects normally. As a result, our application cannot initiate the SMTP send to the ETT on port 25 directly from within the platform. (Receive over IMAP 143 is unaffected.)
Given that, two questions on the b.1 SMTP Send tests (Test 8 / 14 / 18):
1. Port. Which TCP port does the ETT SMTP server (james.healthit.gov) expect for the b.1 SMTP send? The test documentation doesn't appear to specify one. In our testing the server answers on port 25 with STARTTLS, while 587 and 465 are closed. Can you confirm 25 is the intended (and only) port for the send tests?
2. Transparent TCP relay. To work around the constraint above, we would route the SMTP connection through a transparent TCP relay hosted outside the cloud platform: a byte-level passthrough that does not terminate TLS or modify the message, so STARTTLS and the server-certificate validation remain end-to-end between our system and the ETT. The Direct sender address and message are unchanged; only the network egress path differs. Is using such a transparent relay acceptable for the b.1 SMTP send test, or does the test require the sending system to connect to james.healthit.gov:25 directly?
Thanks very much for your guidance.