Disable Server Response Inspection for our SMTP server?

[abrrymn]

We are having horrible delays with email taking up to 30 minutes to be delivered. Our email servers send mail to a 3rd party email security provider. So, I disabled DSRI from our SMTP server to their SMTP server. Email speed was back to being delivered in seconds. I wanted to have someone else confirm that my thinking is correct on this that it was the right thing to disable?

[HULK · Accepted solution]

Hello,

Yes, it will not have any negative impact, but it will speed up the performancee. Typically DSRI is used in environments where internal servers are trusted and protected by the firewall. In these cases, content inspection can be configured for only client to server (internet users to internal servers) traffic using the DSRI option. By doing this, the Server to Client flow (internal servers to internet clients) is skipped after sufficient data has been inspected by the firewall.

Thanks

[hshah · Accepted solution]

Hi Abrrymn,

Following document should be helpful.

Improving Performance of HTTP with DSRI

Regards,

Hardik Shah

[Gchander]

Can DSRI be enabled for any thing any rule or is this only helpful in case of HTTP requests.

[S.Cantwell]

The rule of thumb is DSRI should only be used for internal traffic, and not for Internet based traffic.

It is OK to have an Internet user check their mail (in your DMZ) and have DSRI on the DMZ (because DMZ is hardened OS, etc)

But is it really not permittable to have DSRI out to Internet (to speed up) because of potential malware, vuln, spyware, 0 day, etc.

Does this help answer your question?