On cron and MUA-MTA connection
I generally create an postfix alias for my cron users. This way all cron job mails are delivered to the aliased address in my lookup table.
- So, a practical answer is:
Cron messages can be sent off server/domain/machine to any arbitrary Internet wide email address.
cron itself can be configured to use any arbitrary
From my cron source tree in Debian Buster:
45 #define MAILCMD _PATH_SENDMAIL /*-*/
46 /* #define MAILARGS "%s -i -FCronDaemon -odi -oem %s" /*-*/
47 #define MAILARGS "%s -i -FCronDaemon -B8BITMIME -oem %s" /*-*/
48 /* -i = don't terminate on "." by itself
49 * -Fx = set full-name of sender
50 * -odi = Option Deliverymode Interactive
51 * -oem = Option Errors Mailedtosender
52 * -t = read recipient from header of message
53 * -or0s = Option Readtimeout -- don't time out
54 * XXX: sendmail doesn't allow -or0s when invoked
55 * by joe user. --okir
58 /* #define MAILCMD "/bin/mail" -*/
59 /* #define MAILARGS "%s -d %s" -*/
60 /* -d = undocumented but common flag: deliver locally?
63 /* #define MAILCMD "/usr/mmdf/bin/submit" -*/
64 /* #define MAILARGS "%s -mlrxto %s" -*/
- So, a second practical answer:
Cron can be compiled to use any arbitrary MTA
As stated in comments and other answers,
cron is acting as a MUA. It doesn't have the code base to handle actually sending the messages anywhere except a predetermined MTA which is located on its own logical machine. It's useful to note, that the logical machine may, in fact, not be the same physical machine.
On Using MTA to Send Emails
Connecting directly to a MTA via its SMTP port
An email can be sent directly through a MTA by connecting to its
SMTP.URL:port and working through any authentication manually.
telnet example.com 25
Will generally work if one has unblocked access to port 25 via connecting ISP. And you'll get a message similar to this:
Connected to example.com.
Escape character is '^]'.
220 mail.example.com ESMTP Postfix (Debian/GNU)
But... most ISP do block port 25 connection. And this method of sending email is cumbersome, so in general, a well designed MUA such as
thunderbird is used.
Why ISPs block the standard SMTP port: 25
Most Internet users connect to the Wide Area Network (WAN) through an Internet Service Provider (ISP). These ISPs generally block common ports that are utilized for running Internet services such as HTTP (80) SMTP (25) and several possible others.
In general ISPs have a Terms and Conditions Agreement with its customers that precludes running an Internet service from its network. There are at least two reasons for this general ISP policy:
- Internet Services consume bandwidth.
- ISPs act as a minimal barrier for many email spammers or malicious web services.
ISPs also generally blacklist their own dynamic IP address pools. So, any mail services running from an ISP dynamic IP address is very likely to either be rejected or placed directly into the "spam" folder of any large email provider.
Blacklisted IP blocking
IP blacklisting is very simple and effective. It's used in the MTA configuration to immediately reject incoming mail that originates from a blacklisted domain.
smtpd_client_restrictions = ...
Example from one of my actual server logs:
Oct 14 04:45:23 xxxx postfix/smtpd: NOQUEUE: reject: RCPT from xxxxx.xxxx.xxxx.jp[xxx.149.xxx.xxx]: 554 5.7.1 Service unavailable; Client host [xxx.149.xxx.xxx] blocked using sbl.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL319039; from=<firstname.lastname@example.org> to=<email@example.com> proto=ESMTP helo=<xxxx.xxx.xxx.jp>
Effectiveness of port blocking and RBLs in the Age of Botnets
These policies were more effective before the current age of on-demand web servers. In my experience, the spammers and malicious actors have simply moved from ISP connected services to botnets and on-demand Command and Control (C&C) servers.
Most of the spam or brute force attacks against my own servers begin with a C&C probe usually run from an Amazon EC2 IP address. Followed by a series of botnets coming from addresses in far off countries somewhere.
ISPs that do not block ports
I'm not sure if any USA ISPs allow all ports. However, I have seen some European ISPs that simply hand consumers the Internet fire hose with no blocked ports and no filters.
So, I don't have an answer for this one except "Check with your ISP".