Why do cloud providers block outbound port 25?

Cloud hosting platforms (AWS, DigitalOcean, Hetzner, Linode) block outbound port 25 by default to prevent newly spun up instances from being weaponized for unsolicited bulk spam campaigns.

Should end users submit email on port 25?

No. End-user email clients (Outlook, Apple Mail, Thunderbird) should submit outbound messages using authenticated Port 587 (Submission) or Port 465 (SMTPS), not Port 25.

How do I check if my mail server port 25 is open?

Use our Open Port Checker to confirm whether external mail servers can reach your port 25 listener, or test from a terminal with 'nc -zv yourdomain.com 25'.

Home/Open Port Checker/Port 25

Port 22 Port 53

Well-Known Port Reference

Port 25: SMTP (Simple Mail Transfer Protocol) (TCP)

Standard protocol for server-to-server email routing and relaying across mail transfer agents (MTAs).

Port Number

Transport

TCP

Security Risk

High

Standard / RFC

RFC 5321

Test Port 25 Reachability Live

Verify whether Port 25 is open, closed, or filtered on your server or public IP address.

Loading port checker...

Service Architecture & Function

Port 25 is the primary gateway for server-to-server mail transmission. Mail Transfer Agents (MTAs) such as Postfix, Exim, and Sendmail listen on port 25 to accept inbound messages destined for local mailboxes or to relay messages across the public Internet. Most consumer ISPs and cloud providers block outbound port 25 by default to combat spam.

Security Profile & Hardening

Misconfigured mail servers that operate as 'open relays' on port 25 can be exploited by spammers to send millions of fraudulent emails, leading to immediate IP blacklisting on Spamhaus and Barracuda. Modern port 25 listeners must require STARTTLS encryption and strict anti-relay rules.

Example Firewall Commands:

# UFW (Ubuntu/Debian)

sudo ufw allow 25/tcp

# iptables (Direct Kernel)

iptables -A INPUT -p tcp --dport 25 -j ACCEPT