Port 25 SMTP · TCP

What runs on port 25

SMTP between mail servers (MTA to MTA). Your mail server must accept port 25 from the whole internet to receive mail, and must be able to reach other servers on 25 to send it. Many cloud providers and ISPs block outbound 25 by default to stop spam, so a fresh VPS often cannot deliver mail until you ask for it to be unblocked. Clients should not use 25 to send; that is what 587 is for.

Software that uses it: Postfix · Exim · Sendmail · Microsoft Exchange · OpenSMTPD

Should port 25 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Check your provider's outbound-25 policy before running a mail server.
• STARTTLS on 25 is opportunistic; MTA-STS and DANE make it enforceable.
• A reverse DNS record matching the HELO name is required by most receivers.

Check port 25

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :25'
sudo lsof -i :25

# from another machine: is it reachable?
nc -zv host 25
nmap -p 25 host
curl -v telnet://host:25      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 25

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 25 proto tcp
sudo ufw deny 25/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 25 accept
nft add rule inet filter input tcp dport 25 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 25 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=25 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 25" with no source is just "open".

Related ports

• 587 SMTP submission — Mail from clients, STARTTLS
• 465 SMTPS — Mail submission over implicit TLS
• 110 POP3 — Mail retrieval, plaintext
• 143 IMAP — Mail access, plaintext/STARTTLS

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions