Re: Block port 25 by default
A surprising number of UK ISPs supplying residential services leave port 25 wide open (although, granted, they may be throttled - I haven't stress tested the connection!). From my (limited) experience it seems that north American ISPs are more diligent on this matter while Australian ISPs are similar to their UK brethren.
Ports 465 and 587 with accompanying authentication protocols are definitely the way forward.
Having outgoing port 25 blocked by default but the possibility of it being opened at the customer's request seems like a reasonable way forward.
Biting the hand that feeds IT
