Port 25

Because spammers occasionally max out the number of SMTP connections (default 30), I usually call this service smtp and use it strictly for external SMTP connections. By running a separate SMTP service for the internal users, a spike in spammer activity doesn't cause connection issues for your internal users.

Set up the service directory, download John Simpson's SMTP run script, and set it's permissions:

Edit /var/service/smtp/run and set the appropriate options. Most of the defaults should be correct, however you will definitely need to set the IP address (perhaps using a virtual interface if you want multiple SMTP servers but don't have multiple NICs installed).

We can allow our internal users to authenticate themselves and relay mail through this service as long as their mail client has TLS encryption:

Enabling some public RBLs is a very good way to prevent a lot of spam. Uncomment RBLSMTPD_PROG="rblsmtpd", then uncomment and modify the RBL_BAD with your preferred RBLs. If you created your own private RBL white and blacklists, add them as well. Currently, I'm using:

Enabling GREETDELAY is a good way to stifle impatient spammers. Simply uncomment:

Uncomment the appropriate QMAILQUEUE line depending on whether you are using Simscan or Qmailscanner. i.e:

Set up the "log" directory, download its "run" script, and set its permissions:

At this point, you should configure validrcptto on your external service. In fact, the service as it is configured by the run script, will not properly accept mail until you do so - given how spammers operate, you should be using it.
Start the SMTP service
Once you have configured validrcptto and other options, create the symbolic link in /service to start the service:

CentOS 7 Firewall