Port 25 – SMTP

TCP

Port 25 is the original SMTP port for server-to-server email delivery. Many ISPs block outbound port 25 to prevent spam. Authenticated email submission uses port 587 (STARTTLS) or port 465 (SMTPS). Mail servers that receive email still listen on port 25.

Port Number

Protocol

TCP

Service

Simple Mail Transfer Protocol

Range

IANA Well-Known (0–1023)

Description

SMTP on port 25 handles mail transfer between servers (MTA to MTA). It operates in the open relay model – any server can deliver to any other server on port 25. Client submission should use port 587 (with STARTTLS) instead. Port 25 is often blocked by ISPs for residential connections.

Security risks

1Open relay misconfiguration: an SMTP server on port 25 that relays mail for any sender gets abused for spam within hours. Verify with: telnet host 25, then MAIL FROM:<[email protected]> – if it accepts without auth, it is an open relay.
2SPF/DKIM/DMARC absence: port 25 accepts mail from any IP claiming any domain. Without SPF (authorized senders), DKIM (message signature), and DMARC (policy), your domain is trivially spoofed for phishing.
3Cleartext transmission: SMTP on port 25 between servers may not negotiate STARTTLS (opportunistic TLS). A network observer between MTAs reads all email content. MTA-STS and DANE enforce TLS for server-to-server delivery.
4Backscatter spam: misconfigured servers that accept mail for invalid recipients, then generate bounce messages (NDR) to the forged sender, become unwitting spam relays.

Firewall guidance

Inbound port 25 must be open on mail servers that receive email from the internet (MX records point here). Block outbound port 25 from all hosts EXCEPT designated mail servers – this prevents compromised machines from sending spam directly. Cloud providers (AWS, GCP, Azure) block outbound 25 by default and require a request to unblock for legitimate mail servers.

Diagnosis commands

Test basic SMTP connectivity and banner

shell

telnet mail.example.com 25

Test STARTTLS support on port 25

shell

openssl s_client -connect mail.example.com:25 -starttls smtp

Find which servers receive mail for a domain

shell

dig MX example.com +short

Send a test email via SMTP (Swiss Army Knife for SMTP)

shell

swaks --to [email protected] --from [email protected] --server mail.example.com:25

Usage examples

Port 25 – SMTP

shell

telnet mail.example.com 25
EHLO sender.example.com
MAIL FROM:<[email protected]>

Common services on this port

PostfixEximSendmailMicrosoft ExchangeHarakaOpenSMTPDhMailServer

Related ports

587

SMTP submission (STARTTLS)

465

SMTPS (implicit TLS)

993

IMAPS (mail retrieval)

110

POP3 (mail retrieval)

History

SMTP was defined in RFC 821 (1982) by Jon Postel. The current version is RFC 5321 (2008). The protocol was designed for an era of trusted networks – authentication was added later via SMTP AUTH (RFC 4954). Port 587 for authenticated submission was standardized in RFC 6409 (2011).

FAQ

Why do ISPs block outbound port 25?

Compromised home computers (botnets) send spam directly via port 25. ISPs block it at the network level to prevent residential IPs from being blacklisted. Legitimate users send via port 587 (authenticated submission) through their provider's mail server.

Do I need port 25 open to SEND email?

No. Sending (submission) uses port 587 with authentication. Port 25 is only needed INBOUND for servers that RECEIVE email from other mail servers. Your application should connect to your SMTP relay on 587, not 25.

Specification

RFC 5321 – Port 25 specification →