Port 25 blocked: why cloud hosts and ISPs block SMTP, and what to do

You set up a new server, point an app at a mail server, and nothing sends. The connection to port 25 just hangs, then times out. Before you change any mail settings, check whether your network allows port 25 at all. On most cloud platforms and home connections, it doesn't, and that is deliberate.

Why is port 25 blocked?

Port 25 is blocked on most cloud servers and home connections because it's the port spam uses to go directly from an infected or abused machine to recipients' mail servers. Port 25 is the standard port for server-to-server mail delivery: every receiving mail server listens on it, and anyone who can open a connection to it can try to hand over a message. Malware on home computers and rented servers used by spammers do exactly that, bypassing any provider that would notice.

Blocking outbound port 25 from networks that shouldn't run mail servers closes that path. The anti-abuse industry group M3AAWG says in its port 25 best practices refresh: "Blocking port 25 for all but a few restricted purposes is still considered an industry best practice." It also tells providers to "provide email submission services on ports 465 and 587" so their customers can still send.

This is why the block rarely affects ordinary users. A mail app or website plugin should send through its provider on port 587 or 465 with a login, not straight to the recipient on port 25. Our guide to SMTP ports 25, 587, 465 and 2525 explains what each port is for. The block hurts in three situations:

• You run your own mail server (Postfix, Exim, Exchange) on a cloud VM or a home line.
• A device or app is configured to deliver directly to recipients instead of using a relay.
• You're testing a remote server's MX host from a laptop or a new cloud server.

How do you check whether port 25 is blocked?

Test a connection to a well-known MX host on port 25, then the same kind of test on a submission port. If 25 times out and 587 connects, port 25 is being blocked between you and the internet.

1. Find an MX host to test against. Use the MX Lookup or nslookup -type=mx gmail.com. Gmail's MX hosts listen on port 25 for every sender on the internet.
2. Test port 25. On Windows, run Test-NetConnection gmail-smtp-in.l.google.com -Port 25 in PowerShell and read the TcpTestSucceeded line. On macOS or Linux, run nc -vz -w 10 gmail-smtp-in.l.google.com 25.
3. Test port 587 for comparison. Run the same command against smtp.gmail.com on port 587.
4. Read the result.

Run the test from the machine that sends the mail, not from your laptop, because each network has its own rules. Our guide to testing an SMTP server with Telnet and OpenSSL covers the full conversation once the port connects.

A connection that opens and then gets refused is a different problem. That's the receiver judging your IP, usually because it lacks proper reverse DNS or is on a blocklist. Check both with the Reverse DNS (PTR) Lookup and the Blacklist Checker.

Which cloud providers block port 25?

Most major cloud and VPS providers block outbound port 25 by default, and their policies differ on exceptions. The table below summarizes each provider's own documentation at the time of writing (November 2026). Policies change, so confirm on the linked page before you plan around them.

The details, in each provider's words:

Amazon Web Services

AWS's EC2 quotas page says that by default, "traffic over port 25 is blocked to public IPv4 addresses and IPv6 addresses", and that "you can request that this restriction be removed." The re:Post article gives the steps: open the Request to remove email sending limitations form, explain your use case and "how you plan to stop unwanted outbound email from your account", and name the Region. "If you have instances in more than one AWS Region, then you must submit a separate request for each Region." The same form can set a reverse DNS record on an Elastic IP, as long as an A record for that name points to the same IP. AWS says the request "might take up to 48 hours to process" and recommends Amazon SES as the alternative.

Microsoft Azure

For subscription types other than Enterprise Agreement and MCA-E, Microsoft Learn says: "The Azure platform blocks outbound SMTP connections on TCP port 25 for deployed VMs." Standard Enterprise Agreement and MCA-E subscriptions aren't blocked, though "there's no guarantee that external domains accept the incoming emails". Enterprise Dev/Test subscriptions are blocked by default; you can request removal by running the Cannot send email (SMTP-Port 25) diagnostic under Diagnose and Solve in the Azure Virtual Network resource. After an exemption, VMs "must be stopped, deallocated, and then restarted". For everyone else, Microsoft recommends an authenticated SMTP relay, noting that port 587 "isn't restricted in Azure, regardless of the subscription type."

Google Cloud

Google Cloud's documentation says "connections to destination TCP Port 25 are blocked when the destination is external to your VPC network", though "some projects do not have this restriction". It "does not place any restrictions" on destination ports 587 or 465.

DigitalOcean, Akamai, Vultr and Hetzner

• DigitalOcean: "SMTP ports 25, 465, and 587 are blocked on Droplets to prevent spam and other abuses on our platform." It recommends a third-party email service and says "we strongly recommend against running your own mail server."
• Akamai (Linode): "restrictions have been placed on outbound connections over ports 25, 465, and 587 on Linodes for some new accounts created after November 5th, 2019". Support reviews requests that include your name, your use case and sending practices, and every domain you'll send from.
• Vultr: "By default, outbound traffic on port 25 is blocked on all new Vultr Compute Instances." A support ticket should give your use case, spam protections such as SPF, DKIM or rate limits, and expected volume; "approval is reviewed case-by-case and not guaranteed."
• Hetzner: "we block ports 25 and 465 by default on all cloud servers." "Once you have been with us for a month and paid your first invoice, you can create a limit request to unblock these ports for a valid use case." "Port 587 is not blocked and can be used without sending a limit request."

Do home and business ISPs block port 25?

Many residential ISPs block port 25, and some block it in both directions. Comcast's Xfinity, for example, says it "does not support port 25 for the transmission of email by our residential Internet customers", citing the "long standing recommendation from M3AAWG" and the IETF "that port 25 be blocked". Its blocked ports list shows port 25 blocked in both directions and recommends port 587 for its own email service.

A two-way block means you can't run a reachable mail server on that line at all: other servers can't deliver to you, and your server can't deliver out. Business plans with static IP addresses often have different rules, so ask your ISP. Even where port 25 is open, mail from residential IP ranges is widely distrusted by receivers, so a home connection makes a poor mail server.

What should you do instead of using port 25?

Send through an authenticated relay on port 587 or 465, and let the relay deliver on port 25 from IP addresses it manages. A relay used this way is called a smart host. This is what every major cloud provider recommends, and it usually delivers better than a fresh cloud IP would anyway. Our guide to what a smart host is covers the concept and the SPF and DKIM changes.

Pick the option that matches your setup:

1. An app or website on a cloud server: use your mail provider's submission service, such as Microsoft 365 or Gmail on port 587, or your cloud's own email service (Amazon SES on AWS, Azure Communication Services on Azure). For WordPress, see WordPress SMTP setup with SPF and DKIM.
2. A Postfix server: set relayhost to the relay's host and port, for example relayhost = [smtp.example.net]:587, and turn on smtp_sasl_auth_enable and TLS. Postfix documents relayhost as "the next-hop destination(s) for non-local mail", and square brackets turn off MX lookups for that host.
3. Printers and scanners: see scan to email with Microsoft 365 or the Google Workspace SMTP relay service.
4. A provider that blocks 587 and 465 too, such as DigitalOcean: use your sending service's HTTPS API, or a submission port your relay documents that your host doesn't block.

Whichever relay you choose, add it to your SPF record and turn on DKIM signing for your domain, or your mail will fail authentication. Also check the relay's limits: Microsoft 365 and Google Workspace cap how much a mailbox can send, as covered in email sending limits.

If your provider lifts the block, what do you need?

Getting port 25 opened is the start, not the finish. Receivers judge every new sending IP, and a cloud IP with no history starts at a disadvantage. Before you send real mail directly:

1. Set a PTR record on the sending IP that names your server, with a matching A record.
2. Use the same name as your HELO/EHLO hostname. See the HELO/EHLO hostname explained.
3. Publish SPF, DKIM and DMARC for every domain the server sends from.
4. Check the IP against blocklists, because cloud addresses are reused and may carry an old listing.
5. Start with low volume and watch bounces and spam-folder placement.
6. Send a test to the deliverability test, which reports reverse DNS, blocklists, TLS and authentication for the message it receives.

Next steps

• Run the port test from the machine that sends mail, and keep the result for your provider's support team.
• If you don't need your own mail server, move the app or device to authenticated submission on 587 or 465 and stop fighting the block.
• If you do need direct delivery, request the exemption from your cloud provider and complete the checklist above first.
• For low-volume sending from servers, devices and contact forms, iBlockSpam's outbound relay is a smart host with DKIM signing and outbound filtering, with 500 messages per domain per month included.