Port 25: SMTP
Port 25 is SMTP, used for server-to-server mail relay over TCP. It is not the port a mail client should use to send mail: that is port 587 for STARTTLS submission or port 465 for implicit TLS submission.
| Port number | 25 |
|---|---|
| Service | Simple Mail Transfer Protocol |
| Protocol | TCP |
| Category | |
| Default encryption | No |
| IANA service name | smtp |
| IANA transports | TCP, UDP |
| Used in practice | TCP |
What is the difference between ports 25, 465 and 587?
They do two different jobs that look similar. Port 25 is for relay: one mail server handing a message to another mail server on the way to its destination. Ports 587 and 465 are for submission: an authenticated user handing a brand new message to their own provider to send on their behalf.
Port 587 is the standard submission port. The connection starts in clear text, then the client issues STARTTLS to upgrade it to TLS before authenticating. Port 465 does implicit TLS instead: the TLS handshake happens first and no SMTP command is ever sent unencrypted.
For years port 465 was described as deprecated. That changed with RFC 8314 in 2018, which recommends implicit TLS in preference to connecting in cleartext and negotiating STARTTLS, and which had IANA register the service name submissions on port 465 specifically for this. So both 587 and 465 are current and correct, and 465 is the one the newer guidance prefers.
Why is port 25 blocked on my connection?
Because a compromised machine on a home or cloud network sending directly to the world on port 25 is what a spam botnet looks like. Most residential ISPs and most cloud providers therefore block outbound port 25 by default, and cloud providers often require a support request to unblock it.
This is why a mail client configured to send on port 25 fails on a home connection while the same client works on 587. Submission traffic was moved to its own authenticated port precisely so that relay traffic on 25 could be filtered without breaking ordinary users.
If you are running a mail server that needs to deliver to other servers, port 25 outbound is not optional, because the receiving side only listens there. That is a hosting decision to make deliberately, alongside SPF, DKIM, DMARC and a clean IP reputation.
Which ports are related to port 25?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 587 | companion | The mail submission port, for a client handing outgoing mail to its own provider. Requires authentication and upgrades to TLS with STARTTLS. |
| 465 | encrypted | Submission over implicit TLS: the connection is encrypted before the first SMTP command, with no plaintext phase at all. |
| 2525 | alternate | An unofficial fallback some providers offer when a network blocks 587. It has no IANA assignment for mail. |
What commonly listens on port 25?
- Postfix, Exim and OpenSMTPD on Linux mail servers
- Microsoft Exchange receive connectors
- Anti-spam gateways and mail relays sitting in front of a mailbox server
How do I check whether port 25 is open?
Port 25 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 25 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 25 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':25 ' | Lists the process bound to port 25 on Linux. On macOS use lsof -nP -iTCP:25 -sTCP:LISTEN, on Windows netstat -ano | findstr :25 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 25 TCP or UDP?
TCP. IANA has historical registrations for smtp on both TCP and UDP at port 25, but SMTP is defined over TCP and no mail software uses UDP. Firewall rules should allow TCP 25.
Should I use port 25 or 587 to send email?
587 for a mail client, or 465 for implicit TLS. Port 25 is for server-to-server relay and is blocked outbound by most ISPs and cloud providers, so a client configured to use it will usually just time out.
Is port 465 deprecated?
No, not since 2018. RFC 8314 recommends implicit TLS over cleartext-plus-STARTTLS and had IANA register the submissions service name on port 465 for exactly this purpose. Both 465 and 587 are valid submission ports today.
What is port 25 used for?
Port 25 is SMTP, used for server-to-server mail relay over TCP. It is not the port a mail client should use to send mail: that is port 587 for STARTTLS submission or port 465 for implicit TLS submission.
Is port 25 secure?
Port 25 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 25 on my firewall?
Only if you specifically need SMTP. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.