Web-based monitoring of SMTP email servers is normally conducted using one of two different approaches. The first uses a socket level connection to verify whether or not the target server is operational. The second more comprehensive method involves sending round-robin messages to your email system and its subcomponents. Depending on your needs, hardware, and company size both have validity and a rightful place. To determine what is best for your company, let’s examine both in more detail and the advantages and disadvantages of each.

Socket connection is the most prevalent method used by web-based monitoring companies due to its simplicity. A DNS check is normally conducted, then a socket level connection to port 25 of your email server is attempted. If DNS is ok and SMTP port 25 handshaking occurs, the server is viewed as operational. If not, the appropriate notification methods are triggered. The socket connection method advantages are: speed, low bandwidth, and no agent or server changes are required. Because of its simplistic design, socket connection monitoring can be used to monitor SMTP servers your company does not own or manage. The disadvantage to this approach is accuracy. Just because DNS is operational and handshaking occurs, it does not mean the server or subcomponents are actually processing messages.

The second, less used, method involves a round-robin process that actually sends test messages to your email systems and waits for the message to be returned. As with the socket connection method, a DNS check is normally performed first. A test message is then sent by the monitoring company to your email system. The message travels through your gateways, any subcomponents such as antivirus and content/spam filters, through the firewall to the designated internal server. The internal server, based on a pre-established server-based rule, returns the message back to the monitoring company. If the message is received by the monitoring company within the preset time, 15 or 30 minutes for example, the email system and subcomponents are viewed as operational. If not, the appropriate notification methods are triggered.

If you are using Microsoft Outlook & Exchange, a server-based rule would look something like this: Apply this rule after the message arrives from EmailVerify@SiteRecon.com and with "Email Verification for" in the subject forward it to "Webmaster@SiteRecon.com

The advantage of this approach includes the ability to check the complete message process for failures. For example, a gateway checked using the socket connection method could be fully operational, yet a connected spam filtering appliance or antivirus process could be hung halting message processing. Depending on the monitoring company, the ability to include a specific type of attachment to the round-robin process is also available. Including an attachment such as the Eicar.Txt text pattern for example, permits subcomponents such as antivirus to be fully tested. The disadvantages to this approach are: increased processing by your servers as this testing method sends 96 messages per day using a 15 minute monitoring interval; creation of an email account to receive the test message; and establishment of a server based rule.

The diagram below outlines the process for both round-robin and socket connect monitoring methods.