What is Port 25?
The short version: it is the port one mail server uses to hand a message to another. If you run your own mail server you need it open; if you send through a relay you do not. Most large cloud providers block it by default.
3
25 for delivery · 587 and 465 for submission
- 25 — server to server
- 587 — client submission, STARTTLS
- 465 — client submission, implicit TLS
- Only 25 is commonly blocked
What is Port 25? The definition.
Port 25 is the TCP port that mail servers use to deliver messages directly to each other. When a mail server has a message for [email protected], it looks up the MX record for example.com and opens a connection to that server on port 25 to hand it over. This is server-to-server delivery, which is different from the port your own mail client uses to submit a message in the first place — that is normally 587 or 465. Because port 25 is how mail actually leaves a machine for the wider internet, and because compromised servers have historically been used to send spam through it in volume, most large hosting and cloud providers block outbound port 25 by default.
- What it does: carries SMTP between mail servers for final delivery.
- Not the same as ports 587 and 465, which clients and relays use for submission.
- You need it if you run your own mail server and deliver mail yourself.
- You do not need it if you send through Amazon SES, SendGrid or similar.
- Commonly blocked: AWS blocks it by default; Google Cloud blocks it to external destinations.
- Open by default here, in both directions, on every plan.
Related: Port 25 VPS · Port 25 · rDNS · SMTP VPS · Which software to run · Which hosts allow it
In More Detail
How a message actually travels
Your mail client submits the message to your own mail server on port 587 or 465, authenticating as it does so. Your server then looks up the recipient domain’s MX record and connects to that server on port 25 to deliver it. The receiving server accepts it and files it in the mailbox. Only the middle step uses port 25, and only that step needs it open outbound on your server.
This is why blocking port 25 does not stop you from reading or sending mail through a provider — it stops your machine from delivering mail directly to the world. That distinction is the source of most confusion about it.
Why providers block it
A compromised or disposable cloud instance that can reach port 25 anywhere is a spam cannon. Blocking the port for every customer is the cheapest way for a large platform to protect its own network reputation, and at the scale of millions of instances it is a defensible decision.
The cost is borne by legitimate senders. AWS states that it “blocks outbound traffic on port 25 for all EC2 instances” and requires a written request that can be refused. Google Cloud blocks connections to external port 25 entirely and points customers at ports 587/465 and third-party senders instead.
When you genuinely need it
You need outbound port 25 when your own machine is the thing delivering mail: running Postfix, Exim, Haraka, Postal or PowerMTA and sending straight to recipients. You also want inbound port 25 unfiltered if your server is going to receive mail.
You do not need it if you relay. Amazon SES, SendGrid, Mailgun and similar accept your mail on 587 or 465 and do the port 25 delivery themselves from their own infrastructure. That is a perfectly good architecture, and for many senders the better one.
What Is Port 25? — Questions
Port 25 open, dedicated IPv4, rDNS on request.
From $4.95 a month with root access from the first second — plus a 7-day money-back guarantee.