restrict outbound https traffic from going to web mail portals

[Daniel_Kavan]

Hi mates,

Is there a way to  restrict outbound https traffic from going to web mail portals.   We want to allow users to use https, but we don't want them to send email.   Also, would outbound https inspection be needed?

[the_rock]

Im thinking one rule to allow port 443 and another to block 25?

Andy

[PhoneBoy · Accepted solution]

You would have to block specific webmail portals to do that, which would most likely require HTTPS Inspection.

[Bob_Zimmerman · Accepted solution]

Not necessarily. As long as Manage & Settings > Blades > Application Control > Categorize HTTPS Websites is enabled, URL Filtering should work. Then as long as you have a services contract for the firewall, you can add a rule to block the "Email" category.

TLSv1.3 with encrypted SNI throws a wrench into this, but it should be possible to block that in various ways, including via Group Policy.

[the_rock · Accepted solution]

I would say this is pretty good AI answer : - )

Andy

*********************

🔐 Why HTTPS Inspection Is Often Necessary

Webmail portals (like Gmail, Outlook Web Access, Yahoo Mail) use HTTPS encryption, which hides the full URL path and content from traditional firewalls. Without HTTPS inspection, you can only see the domain name (e.g., mail.google.com) — not the full URL (e.g., mail.google.com/inbox) or user actions.

• Without HTTPS Inspection: You can block domains like mail.google.com, but you can't block specific actions like sending emails or accessing attachments. [techdocs.b...oadcom.com]
• With HTTPS Inspection: You decrypt the traffic temporarily, inspect it, and re-encrypt it. This allows:
  • Full URL filtering
  • Content inspection (e.g., blocking uploads)
  • More granular control over user behavior [www.cloudflare.com], [sslinsights.com]

---

✅ Best Practices for Blocking Webmail Access

Here’s how to implement this securely and effectively:

1. Enable HTTPS Inspection (SSL/TLS Interception)

• Use a firewall or secure web gateway that supports SSL inspection.
• Deploy a trusted root certificate to user devices to avoid browser warnings.
• Limit inspection to high-risk categories (e.g., webmail, social media) to reduce privacy concerns. [sslinsights.com]

2. Use URL Filtering

• Block known webmail domains (e.g., mail.google.com, outlook.live.com, mail.yahoo.com) using domain-based filtering. [techdocs.b...oadcom.com]
• Use category-based filtering to block “Webmail” or “Email” categories in your firewall or proxy settings. [knowledgeb...tworks.com]

3. Apply Application Control

• Use App-ID or similar technology (e.g., Palo Alto, Fortinet, Cisco) to detect and block webmail applications based on behavior, not just URLs. [knowledgeb...tworks.com]

4. Whitelist Essential HTTPS Sites

• Allow HTTPS traffic to trusted business-critical domains.
• Avoid blanket HTTPS blocking — instead, use a “default deny” policy with specific allow rules. [securemyorg.com]

5. Monitor and Log

• Enable logging for blocked attempts to access webmail.
• Review logs regularly to identify bypass attempts or misconfigurations.