Core protection "SMTP STARTTLS Command"

s_milidrag — Thu, 16 Apr 2026 15:08:13 GMT

Dear Check Mates,

I need some additional clarification about Core protection signature "SMTP STARTTLS Command" which is by default in Prevent mode.

Does this signature, prevent all STARTTLS over SMTP (port 25) or does it block only some irregular communication?

My network topology is very simple; SMTP gateway is behind Check Point firewall and perform NAT and access control.

Is it safe & recommended to switch this signature in DETECT mode.

Re: Core protection "SMTP STARTTLS Command"

PhoneBoy — Thu, 16 Apr 2026 23:58:09 GMT

This protection seems to trigger with some legit SMTP servers: https://support.checkpoint.com/results/sk/sk166472
In these cases, an exception should be applied.