PORTOpportunistic TLS (STARTTLS)IANA assigned
Port 25SMTP (mail relay)
Port 25 is the standard TCP port for SMTP, used for server-to-server delivery of email across the internet. Mail clients should not use it; they submit mail on port 587 (or 465). Most residential ISPs and cloud providers block outbound port 25 to limit spam.
What port 25 is used for
When you send an email, your mail client hands it to your provider's server on port 587. That server looks up the recipient domain's MX record in DNS, then connects to the recipient's mail server on port 25 to deliver it. Port 25 is therefore the internet's mail backbone: every domain that receives email must have a server listening on it.
Three ports, three jobs:
| Port | Name | Who connects | Purpose |
|---|---|---|---|
| 25 | SMTP | Mail servers | Relay between domains |
| 587 | Submission | Mail clients | Authenticated sending to your own provider |
| 465 | Submission over TLS | Mail clients | Same as 587 but with TLS from the first byte |
Encryption on port 25
Server-to-server SMTP started as plain text. Most servers now advertise STARTTLS, which upgrades the connection to TLS if both sides support it. Because the upgrade is opportunistic, a network attacker can strip the STARTTLS offer and force plain text; MTA-STS and DANE exist to make TLS mandatory for domains that publish the policy. Assume that mail in transit on port 25 may be readable unless both domains enforce TLS.
Why outbound 25 is blocked
Residential ISPs, mobile carriers and every major cloud provider block or throttle outbound connections to port 25 by default. The reason is spam: a compromised machine that can reach any mail server on 25 can deliver spam directly, bypassing its provider's controls. Cloud providers usually lift the block on request for accounts with a verified sending use case.
Security considerations
- Only mail servers should listen on 25. A workstation with a 25 listener is running an unexpected MTA.
- Do not run an open relay. A server on 25 must accept mail only for domains it hosts, or from authenticated users. Open relays are blacklisted within hours.
- Publish SPF, DKIM and DMARC so receiving servers can authenticate your mail and reject forgeries.
- Rate-limit and monitor inbound connections; port 25 receives constant probing and dictionary attacks against recipient addresses.
How to check port 25
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :25A line in the LISTENING state means a local program has bound port 25; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :25 or lsof -i :25.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection mail.example.com -Port 25TcpTestSucceeded : True means the remote system accepted a TCP connection on port 25. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Look up which server accepts mail for a domain:
nslookup -type=MX example.comFirewall considerations
Mail servers need inbound TCP 25 from anywhere, since any domain may deliver to them. All other systems should allow no inbound 25. Outbound 25 from workstations and application servers can be blocked at the edge; anything that needs to send mail should relay through the organisation's mail server on 587.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 25 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Why is port 25 blocked by my ISP?
Compromised home computers were the main source of spam for years. Blocking outbound 25 from residential connections stops that traffic while leaving legitimate users unaffected, because their mail apps use port 587 or 465 to reach their provider.
Should my mail client use port 25?
No. Use 587 with STARTTLS or 465 with implicit TLS, with authentication. Port 25 is for server-to-server relay and many providers do not accept authenticated submission there.
How can I check if a mail server accepts connections on 25?
From a network where outbound 25 is not blocked: Test-NetConnection mail.example.com -Port 25. A successful TCP test followed by a 220 banner (visible with curl -v smtp://mail.example.com) means the server is listening.