Port 25 — TCP
TCP port 25 mainly carries SMTP traffic between mail servers. Modern authenticated client submission normally uses a dedicated service, so assess exposure and filtering according to the server's actual role.
What is port 25 used for?
A server that directly receives email for a domain may need to accept Internet connections on TCP 25. This differs from authenticated submission by users or applications, which commonly uses ports such as 587 or 465 according to the provider.
Distinguish SMTP connectivity, TLS negotiation, relay policy and the server's final decision on a message.
Transport protocol
TCP
Security precautions
Prevent open relaying and use the designated submission service for authenticated users.
Should we open this port in the firewall?
Internet exposure can be normal for an MX server, but relay rules must prevent it from becoming an open relay. Use the platform's intended submission mechanisms, enable TLS where available and monitor rejections, queues and unusual behavior.
How do I check this port?
Start with Test-NetConnection SERVER -Port 25 to check TCP connectivity. Then inspect the SMTP banner and EHLO capabilities. If STARTTLS is offered, openssl s_client -starttls smtp -connect SERVER:25 helps inspect TLS negotiation.
- Identify the server expected to accept the message and its destination domain.
- Read the exact SMTP response, especially 4xx or 5xx codes.
- Check DNS/MX records, TLS and sender or recipient policies as appropriate.
- Separate network transport failures from SMTP application rejections before blaming the port.
FAQ — port 25 / SMTP
Should port 25 always be closed to the Internet?
No. A server receiving email directly for a domain may need inbound SMTP on port 25. The decision depends on its role.
Why use port 587 instead of 25 for an email client?
Port 587 commonly provides authenticated submission by users and applications, while port 25 mainly handles server-to-server transport.
Does a successful TCP test guarantee email delivery?
No. The server may accept a connection and then reject the message because of authentication, relay restrictions, recipient policy, reputation or another SMTP condition.