Check your "static (dmz,outside)" is correct.
Check your ACL is correct and allows the traffic to reach the public ip.
Check you ACL is applied "in" on the outside using access-group.
If your SMTP server uses ESMTP disable mailguard "no fixup protocol smtp 25" or upgrade to version 7.n (check memory support first).
Example...
static (dmz,outside) 88.77.66.55 10.1.1.1
access-list public-in permit tcp any host 88.77.66.55 eq 25
access-group public-in in interface outside
If the above is "already correct", then disbable mailguard.
no fixup protocol smtp 25
Notes.
Where 88.77.66.55 is your public/DNS address for your mail server MX record. And 10.1.1.1 is your private internal IP of the SMTP server.
If you are not using VLANs and only have two interfaces - inside and outside - this is a security risk when hosting any applications - but can be done if you accept the risks. In this case I recommend an external mail filtering company such as messagelabs or blackspider so that the source of your email can be a limited number of systems. I would NOT recommend hosting a web server without a dedicated DMZ. If this has to be done - ensure that the very latest applications and OS patches are always applied, ensure that AV software is updated. Consider/implement private VLANs, Consider HIDS/HIPS on the servers AND all other internal systems. Protect your users from your own public SMTP/WWW servers as best you can. Much less risk with a DMZ!
I assume you can send email because you are successfully using NAT but have not configured the static and/or ACL as above. Take great care when allowing access to your systems.
