Win Web Hosting

dont know dont care

A single mail server in the DMZ will involve the least amount of work and will serve internal and external users without punching holes in the firewall. It’s okay to run WWW on the same server if you have a modest amount of mail, users, or web traffic. Naturally, the busier it gets the more computer you will need.

If you want to have your POP/IMAP server inside and your SMTP server outside, set up your inside server to listen only to port 25 traffic coming from your outside server. Let the outside server do the filtering and forward all the clean mail inside. (Don’t poll for mail unless you’re REALLY paranoid, it slows delivery down).

To add a webmail server to this, set up the same kind of trust arrangement. Most of them use IMAP to query the mail server, so open just port 143 between the web server and the inside server.

POP access from the outside is a trickier one to answer. You could go for a proxy server in the DMZ to intercept the requests or you could bite the bullet and let the inside server handle it. I’d recommend SSL encryption for that, both to protect the user’s unencrypted POP password and to help remind users that they need to keep security in mind.