Port 25 blocked on a VPS: why and how to send email anyway

Your app's emails never arrive and the logs show connection timeouts to remote mail servers. Very often the cause is simple: outbound port 25 is blocked on the VPS. This guide explains why and how to send email reliably anyway.

Before you start

• SSH access to the VPS.
• An account with an SMTP relay or transactional email service, or a mailbox with SMTP access.

Why providers block port 25

Port 25 is used for server-to-server email. Compromised or abused VPSs are a major source of spam, so many cloud and VPS providers block outbound port 25 by default, or only open it on request for accounts in good standing. Ports 587 and 465 (authenticated submission) are usually open.

Test whether port 25 is blocked

nc -vz -w 5 gmail-smtp-in.l.google.com 25

A timeout while port 587 to your relay works (nc -vz smtp.yourrelay.example 587) means outbound 25 is filtered.

Option 1: ask the provider to unblock

Some providers will open port 25 after verification. If you run your own mail server you will also need correct reverse DNS (see reverse DNS setup), SPF, DKIM and DMARC, and a clean IP reputation. Running a mail server well is real work.

Option 2: relay through SMTP on port 587

Configure Postfix to hand all mail to an authenticated relay:

sudo apt install -y postfix libsasl2-modules

Choose Internet with smarthost or edit /etc/postfix/main.cf:

relayhost = [smtp.yourrelay.example]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt

Create /etc/postfix/sasl_passwd:

[smtp.yourrelay.example]:587 username:password

sudo chmod 600 /etc/postfix/sasl_passwd && sudo postmap /etc/postfix/sasl_passwd && sudo systemctl restart postfix

Test: echo "test" | mail -s "Relay test" you@example.com (from mailutils), and watch /var/log/mail.log.

Option 3: send from the app directly

Many frameworks and CMSs can send via SMTP on 587 or via a provider's HTTP API, with no local mail server at all. For WordPress see WordPress SMTP setup.

Make mail land in the inbox

• Add the relay's SPF include and DKIM records to your domain's DNS.
• Publish a DMARC policy.
• Use a From address on your own domain that the relay is authorised to send.

Troubleshooting

• SASL authentication failed: wrong credentials, or the hash map was not rebuilt with postmap.
• Mail marked as spam: missing SPF/DKIM/DMARC.
• Still timeouts: port 587 is also blocked by your own firewall; allow outbound.

Frequently asked questions

Does this affect receiving email?

Usually not; inbound 25 is typically allowed. The block is on outbound connections.

Is port 465 or 587 better?

Both are authenticated submission. 587 uses STARTTLS, 465 implicit TLS; use what your relay recommends.

Can I avoid running mail on a VPS?

Yes, cPanel hosting includes email with webmail; see MdmHost web hosting.

Next steps

• WordPress SMTP setup
• Reverse DNS setup
• First steps on a new VPS