{
  "port": 10025,
  "protocol": "tcp",
  "service": "MTA reinjection (post-filter SMTP)",
  "oneLiner": "The stripped-down SMTP listener a content filter reinjects already-scanned mail into.",
  "whatItIs": "Also unregistered with IANA. In the standard amavis setup, master.cf runs a second Postfix smtpd on 127.0.0.1:10025 with most checks disabled, and amavis returns clean mail to it via `$forward_method='smtp:[127.0.0.1]:10025'`. Postfix's own FILTER_README documents the same sandwich with a 10025/10026 pair. A probe sees an ordinary Postfix ESMTP banner, which makes the port easy to mistake for a legitimate public MTA.",
  "exposure": {
    "verdict": "never",
    "note": "This listener deliberately runs with relay restrictions and receive overrides removed so that filtered mail passes unchallenged. Reachable from the internet, it is a literal open relay — bind it to the loopback interface."
  },
  "checkCommand": "printf 'QUIT\\r\\n' | nc -w 3 127.0.0.1 10025",
  "links": [
    {
      "title": "Postfix — FILTER_README (SMTP-based content filter port sandwich)",
      "url": "https://www.postfix.org/FILTER_README.html",
      "kind": "official-docs"
    },
    {
      "title": "amavis — README.postfix (reinjection on 127.0.0.1:10025)",
      "url": "https://www.amavis.org/README.postfix.html",
      "kind": "official-docs"
    }
  ]
}