What runs on port 25
TCP port 25 is SMTP (RFC 5321), the protocol mail servers use to hand messages to each other. When someone sends mail to you@example.com, their server looks up the MX record of example.com and connects to that host on port 25. It is the server-to-server port: mail apps and scripts that send through your provider should use port 587 or 465 instead.
SMTP on 25 starts unencrypted. Servers upgrade with STARTTLS when both sides support it, which nearly all do today, but by default the encryption is opportunistic: if it fails, mail may still go through in clear text. MTA-STS lets a domain require TLS.
Should it be open to the internet?
| Your server | Port 25 inbound |
|---|---|
| Receives mail for your domain (it's in your MX) | Must be open |
| Only sends mail (web app, notifications) | Keep closed |
| Not a mail server at all | Keep closed |
If you run your own mail server, 25 must be reachable from everywhere, since any server in the world may deliver to you. In ufw: sudo ufw allow 25/tcp.
Outbound port 25 is often blocked
Many residential ISPs and cloud providers block outgoing connections to port 25 by default, to stop infected machines and new accounts from sending spam directly. Policies differ by provider and change over time: some lift the block on request, some never do. If your server cannot connect to other mail servers on 25, check your provider's documentation, or relay through a mail service on 587.
Test it from the server:
nc -zv mx1.example.net 25
A timeout here while other ports work almost always means an outbound block.
Don't be an open relay
An open relay accepts mail from anyone to anyone, and spammers find one within hours. It gets your IP on blocklists. In Postfix, the default restrictions only relay for local networks and authenticated users:
# /etc/postfix/main.cf
mynetworks = 127.0.0.0/8 [::1]/128
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
Never add broad ranges like 0.0.0.0/0 to mynetworks.
Test SMTP by hand
telnet mail.example.com 25
220 mail.example.com ESMTP Postfix
EHLO test.example.net
250-STARTTLS
...
QUIT
To test the TLS upgrade: openssl s_client -connect mail.example.com:25 -starttls smtp.
See what is listening
sudo ss -tlnp 'sport = :25'
sudo lsof -i :25
On many Linux servers a local MTA (Postfix, Exim, sendmail) listens on 127.0.0.1:25 only, which is fine: it accepts mail from local programs and is not reachable from outside. "Address already in use" when starting a second mail server means one of these is already bound.
Security notes
- Reverse DNS: a sending server's IP needs a PTR record that matches its hostname, or many receivers reject it.
- Authenticate your domain with SPF, DKIM and DMARC.
- Don't allow AUTH on 25 for users unless you have to; keep client submission on 587/465.
Related ports
- Port 587 (Submission): where mail clients and apps send.
- Port 465 (SMTPS): submission with TLS from the start.
- Port 143 (IMAP): reading mail.
Check that your domain's mail records are in order with the Email Checker, and see whether port 25 answers from outside with the Port Scanner.