Port 25 (SMTP): Uses and Security

What uses port 25

When a mail server sends a message to another domain, it looks up the domain’s MX record and connects to port 25 on that server. Port 25 is for server-to-server relay; email clients and applications should submit mail on port 587 (or 465) with authentication. Many cloud providers and ISPs block outbound port 25 by default to stop spam from compromised machines.

Should port 25 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

Can’t send from an AWS, Google Cloud or Azure VM? Outbound 25 is blocked by default. Use port 587 with an email service like SES, SendGrid or Postmark, or request removal of the limit.
A mail server that accepts mail for any destination is an open relay and will be blacklisted within hours. Only relay for authenticated users or your own domains.

Check what is listening on port 25

Linux

sudo ss -ltnp 'sport = :25'

macOS

sudo lsof -nP -iTCP:25 -sTCP:LISTEN

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 25 -State Listen
netstat -ano | findstr :25

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 25

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:25 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 25 -State Listen).OwningProcess

Open port 25 in the firewall

Ubuntu / Debian (ufw)

sudo ufw allow 25/tcp
# Close it again:
sudo ufw delete allow 25/tcp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-port=25/tcp
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "SMTP 25/TCP" -Direction Inbound -Protocol TCP -LocalPort 25 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 25 from another machine

macOS / Linux

nc -zv example.com 25

Windows (PowerShell)

Test-NetConnection example.com -Port 25

Related ports

Port 587 (SMTP submission): the standard port for sending email from apps and mail clients.
Port 465 (SMTPS): used for email submission over implicit TLS (SMTPS).
Port 143 (IMAP): used by IMAP for reading email that stays on the server.
Port 110 (POP3): used by POP3 for downloading email from a mail server.

More email ports

993 (IMAPS) , 995 (POP3S) . See all ports in the port lookup.

Sources

IANA port registry: 25

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 25 used for?

Port 25 is used by SMTP for delivering email between mail servers. When a mail server sends a message to another domain, it looks up the domain’s MX record and connects to port 25 on that server. Port 25 is for server-to-server relay; email clients and applications should submit mail on port 587 (or 465) with authentication. Many cloud providers and ISPs block outbound port 25 by default to stop spam from compromised machines.

Is it safe to open port 25?

This port is meant to be reachable by clients on the internet when you run this service publicly. Keep the service behind it up to date and require authentication where it applies.

How do I check if port 25 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :25'" on Linux or "sudo lsof -nP -i :25" on macOS. From another machine, run "nc -zv host 25" or, on Windows, "Test-NetConnection host -Port 25". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.