Port 25 — SMTP

TCP well-known

What runs on port 25

Server-to-server mail transfer.

Port 25 is server-to-server mail relay, not mail submission. Nearly every residential ISP and cloud provider blocks outbound 25 by default because it is the port spam is sent from — if your application cannot send mail from a cloud VM, this is almost always why. Use 587 with authentication for sending. An open relay on 25 will be found and abused within days, and the resulting blacklisting takes far longer to undo than it took to happen.

Security considerations

Most residential ISPs and cloud providers block outbound 25 to limit spam. For sending mail from an application use port 587 with authentication.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :25
sudo ss -lntp | grep :25

# Windows
netstat -ano | findstr :25
Get-NetTCPConnection -LocalPort 25

# is it reachable from outside?
nc -zv example.com 25
curl -v telnet://example.com:25

Freeing the port

# find the process, then stop it
sudo lsof -ti :25 | xargs kill        # Linux / macOS
netstat -ano | findstr :25            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Only on a mail server. If this port is open on something that is not intentionally handling mail, you may be running an open relay — which will get the IP blacklisted quickly.

Opening or blocking port 25

This one is meant to be reachable, so the blanket rule is the normal answer and the narrow form under it is for the case where the service is internal-only:

# ufw — Debian, Ubuntu
sudo ufw allow 25/tcp
sudo ufw allow from 10.0.0.0/8 to any port 25 proto tcp   # if it only serves internally

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=25 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 25 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 25 -j DROP

# Windows
New-NetFirewallRule -DisplayName "SMTP 25" -Direction Inbound -Protocol TCP -LocalPort 25 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Frequently asked questions

Other common ports

• Port 53 — DNS
• Port 67 — DHCP server
• Port 68 — DHCP client
• Port 69 — TFTP
• Port 80 — HTTP
• Port 110 — POP3
• Port 123 — NTP
• Port 143 — IMAP
• Port 161 — SNMP
• Port 389 — LDAP
• Port 443 — HTTPS
• Port 445 — SMB
• Port 465 — SMTPS
• Port 514 — Syslog
• Port 587 — SMTP submission
• Port 636 — LDAPS
• Port 993 — IMAPS
• Port 995 — POP3S

All port numbers