SMTP Port 25 Blocked: How to Test and Fix It

Do not index

Outbound SMTP port 25 is usually blocked by the internet service provider or cloud network, so applications should send through port 587 with STARTTLS or port 465 with implicit TLS, or through an authenticated relay. Correct passwords, SPF, DKIM and DMARC can't fix a connection that never reaches the mail server.

That's the counterintuitive part. A timeout before any SMTP banner isn't an authentication failure at all. It's a network policy decision made before the destination server gets a chance to answer.

Table of Contents

Why ISPs and Clouds Block Outbound Port 25 What the defaults mean in practice How to Test Whether Port 25 Is Blocked Five steps from the sending host How to verify it Request an Exception or Use an Authenticated Relay What an exception request actually involves Switch to Port 587 or 465 Without Breaking Your App Six configuration steps Which SPF, DKIM and DMARC Mistakes Break Mail After the Switch Record checklist for the new route Confirm the Fix Before You Go Live Read the test results FAQ

Why ISPs and Clouds Block Outbound Port 25

Port 25 carries mail between servers, so providers restrict outbound access to limit abuse from compromised devices and protect the reputation of shared network addresses. Consumer ISPs and cloud platforms apply different rules, and exceptions depend on the provider and account.

Environment	Outbound port 25 default	Use instead	Confirm in
Residential or consumer ISP	Often blocked; policy varies by provider	Submission on 587 or 465 through the ISP or an authenticated relay	ISP support documentation
Amazon Web Services EC2	Blocked to public IPv4 and IPv6 by default; private IPv4 allowed	587, 465, or Amazon SES	Amazon EC2 documentation
Google Cloud	Blocked by default in many projects	587 or 465 with TLS	Google Cloud firewall documentation
Microsoft Azure	Blocked for many subscription types	587 or 465	Microsoft Learn, by subscription
Tencent Cloud CVM	Blocked to external TCP 25 by default	587 or 465	Tencent Cloud documentation

What the defaults mean in practice

For example, an EC2 instance attempting direct delivery to a recipient's mail server over public IPv4 can time out because outbound port 25 is blocked by default. Changing the domain's MX, SPF, or other DNS records does not change that network rule. Use an authenticated submission service or relay, or check whether the provider offers an exception for your account.

Tencent Cloud's CVM documentation says external TCP port 25 access is blocked by default for security reasons. Rules and exceptions vary across providers, accounts, regions, and subscription types, so check the applicable provider documentation before choosing a sending path.

How to Test Whether Port 25 Is Blocked

A timeout before any SMTP banner means the network dropped the connection. A 220 banner followed by a 4xx or 5xx reply means port 25 is open and the fault sits at the SMTP layer, in authentication, relay authorization, TLS, reverse DNS or recipient policy. Every test must run from the server or runtime that sends the mail, not from a developer laptop on a different network.

Five steps from the sending host

Find the MX host: Run dig +short MX example.com, replacing example.com with the recipient domain in this example. No MX returned points to a DNS problem, not a port block.

Test TCP reachability: Run nc -vz -w 10 mx1.example.com 25 on Linux or macOS, or Test-NetConnection -ComputerName mx1.example.com -Port 25 in PowerShell. Success means the port is reachable, a timeout means packets are dropped, and an immediate refusal points to a host firewall or closed listener.

Read the banner: Run openssl s_client -starttls smtp -connect mx1.example.com:25 -crlf, then type EHLO example.com. A 220 banner and a reply to EHLO is a pass, while silence before the banner confirms filtering.

Repeat against a second MX host: One reachable host doesn't prove the path is open, because a single recipient can rate-limit or drop traffic and produce a false diagnosis.

Test submission ports: Run openssl s_client -starttls smtp -connect smtp.example.com:587 -crlf and openssl s_client -connect smtp.example.com:465 -crlf. A timeout on both means outbound submission is filtered too, usually by a security group, NAT gateway or egress policy.

How to verify it

Run a check to test SMTP ports for the submission service after the command-line tests. A good result shows connection, encryption and authentication succeeding. A bad result splits cleanly: timeouts belong to the network, while a 535 5.7.8 reply belongs to credentials.

Request an Exception or Use an Authenticated Relay

Three options exist once a block is confirmed: request a provider exception, send through an authenticated relay, or deliver directly to recipient MX hosts on port 25 from a host that permits it. For most application senders, the relay is the right design rather than a workaround, because the relay operates the IP pool, bounce handling and rate limits.

Option	Use when	Trade-off	Confirm in
Submission on 587 or 465 to a mailbox provider	Application or device sends through Google Workspace or Microsoft 365	Requires credentials and follows provider sending limits	Provider SMTP documentation
Authenticated relay such as Amazon SES	Transactional or marketing sends from servers	DNS setup on the domain and a relay dependency	Relay SMTP settings page
Provider exception request for port 25	Self-hosted server must deliver directly to recipient MX hosts	Review takes time and requires a use case plus abuse controls	Cloud provider documentation
Direct-to-MX delivery on port 25	Self-hosted mail server with static IP and reverse DNS	Owner carries reputation, bounces and abuse monitoring	Host acceptable use policy

What an exception request actually involves

Amazon Web Services guidance on the EC2 port 25 restriction states that a removal request must include an email address for updates, a description of the sending use case, controls to prevent unwanted outbound email and the AWS Region, and that processing may take up to 48 hours. Changing a security group doesn't clear that restriction, because it sits at the service level rather than the instance level.

Direct delivery demands a static IP, a matching PTR record, abuse monitoring and a host whose policy explicitly allows outbound port 25. Readers sending through Google Workspace accounts benefit from understanding outgoing mail handoffs before choosing between mailbox submission and a dedicated relay.

Switch to Port 587 or 465 Without Breaking Your App

Ports 587 and 465 carry client and application submission, which requires authentication. Port 25 carries relay between servers. Swapping the number without changing the destination host, credentials and encryption mode is the most common way teams turn one failure into another.

Port	Encryption	Purpose	Authentication
25	Opportunistic STARTTLS between servers	Server-to-server relay and delivery	Not used for client login
587	STARTTLS, upgraded from plain text	Client and application submission	Required by submission services
465	Implicit TLS from the first byte	Submission over TLS	Required by submission services

Six configuration steps

Copy the exact settings: Take the submission host, port and encryption from the provider's official documentation, since hosts differ by region and plan.

Match the pair: Set 587 with STARTTLS or 465 with SSL/TLS. A mismatched pair produces timeouts or TLS handshake failures that look like another block.

Use the full login name: Submission services often expect the complete email address, and some relays issue a separate SMTP username instead.

Handle modern sign-in: Create an app password or use OAuth where the provider requires it, because the normal mailbox password may be rejected.

Open egress: Allow outbound traffic on the chosen port in the host firewall, security group or container egress policy.

Send one test message: Deliver to a mailbox under the sender's control and read the result before moving production traffic.

RFC 4409 on message submission reserves port 587 for message submission by mail clients and applications, while relay and final delivery continue over port 25. That's why 587 fixes application sending only when the destination accepts authenticated client mail, and why teams comparing the two submission options should choose the right SMTP submission port rather than treating them as interchangeable.

Which SPF, DKIM and DMARC Mistakes Break Mail After the Switch

A route change alters which servers send mail for a domain, so SPF and DKIM must describe the new path while the visible From domain stays unchanged. Connectivity can pass and authentication can still fail on every message.

Record checklist for the new route

Keep one SPF record: Publish a single TXT record at the root beginning with v=spf1 and add the relay include, for example include:amazonses.com for Amazon SES, after confirming the exact value with the provider.

Count the lookups: Keep the total at or under the standard SPF limit of 10 DNS lookups, since nested include chains push records over it.

Publish the relay DKIM records: Enable signing in the relay and publish the records provided, often CNAMEs, using the exact selector the service issued. Teams can also check your DKIM record as an additional lookup while confirming the selector resolves.

Stage DMARC: Hold p=none while reports confirm alignment, then tighten the policy.

Set PTR only for direct delivery: A static sending IP needs reverse DNS, while relay senders don't publish PTR for relay IPs.

Mistake	Symptom	Fix	mailX tool
Two SPF TXT records	SPF returns permerror	Merge into one `v=spf1` record	SPF checker
More than 10 DNS lookups in SPF	SPF returns permerror	Remove unused includes or flatten	SPF checker
Wrong DKIM selector	No DKIM key found	Use the selector the service published	DKIM checker
CNAME instead of TXT for SPF or DMARC	No valid record at the name	Publish a TXT record	TXT lookup or CNAME lookup
Wrong port and encryption pair	Timeout or TLS failure	Use 587 STARTTLS or 465 implicit TLS	SMTP test
App password missing	535 5.7.8 credentials rejected	Create an app password or use OAuth	SMTP test

Confirm the Fix Before You Go Live

A port change is only complete when the application can connect, authenticate, and deliver a message through the intended route. Check the network connection first, then verify the sending records and inspect a test message before production traffic begins.

Read the test results

An SMTP test for a mailbox you control can confirm whether connection, encryption, and authentication succeed. A timeout before the SMTP banner points to a network or firewall problem, not a wrong password or an SPF or DKIM error. An authentication failure instead directs attention to the credentials or app-password requirements.

Then check SPF, DKIM, DMARC, and the sending IP or relay against blacklists. Confirm that SPF has a single record authorizing the relay and stays within the 10-lookup limit, the DKIM selector returns a valid public key, and DMARC is published at p=none or a stricter policy. Finally, send one message to an external mailbox and review its headers before switching production traffic.

The walkthrough below demonstrates how to interpret an SMTP test result by result.

FAQ

Does switching from port 25 to 587 change SPF or DKIM? The port itself does not. A different relay or mailbox provider may send from different servers, so SPF must authorize that provider, and DKIM signing must be enabled with its selector published in DNS for DMARC alignment to pass.

What if an AWS port 25 exception is not suitable? Use Amazon SES as an authenticated relay on port 587 or 465 instead of sending directly over port 25.

Why can an SMTP test pass while the application still fails? The test and application may use different networks, firewall rules, or connection settings. A passing test confirms that the tested route and credentials work. Check the application's egress rules, port and encryption pair, environment variables, and stored password.

Run the SMTP test, SPF, DKIM, DMARC, and blacklist checks for the new sending route with mailX, free with no signup, and review the plain-English fixes for any failures. Teams building AI agents can also run checks through MCP in ChatGPT, Claude, or Cursor.