BRev Port 25 — SMTP
Port 25 is where one mail server hands a message to another. That is its only remaining job: it is not the port a mail client uses to send (that is 587, or 465), and configuring Outlook or Thunderbird to use 25 is the most common cause of “my mail worked at the office and not at home”. The split exists because the two roles need opposite policies — a receiving MX accepts mail from strangers, a submission port only accepts mail from authenticated users.
Outbound 25 is blocked almost everywhere by default: residential ISPs block it to stop infected machines spamming, and AWS, Azure, GCP, DigitalOcean and Hetzner all restrict it on new accounts for the same reason. This is a policy decision at the network, not a firewall you control, and it is why a new cloud VM can receive mail on 25 but not send to the world until the restriction is lifted on request.
Our reference marks 25 “expose with care”, and the care is specific: it must be public on a real mail exchanger, because that is how mail arrives, but it must never relay for unauthenticated senders. An open relay is found by scanners within hours and is on every blocklist by the end of the week — after which your legitimate mail stops being delivered too.
Port 25 at a glance
| Field | Value | Detail |
|---|---|---|
| Port | 25 | Well-known |
| Service | SMTP | Server-to-server mail delivery. (TCP) |
| Category | Mail | sending and collecting email |
| Exposure | Care | Expose with care |
Should port 25 face the internet? Public only on a real mail exchanger — never an open relay, and never for client submission.
Legitimately public in some setups, but only hardened — current version, real authentication, rate limits, and ideally an allow-list.
What commonly goes wrong
Mail sends from the office and times out from home
The client is configured for port 25 and the home ISP blocks outbound 25. Change the client to 587 with STARTTLS and authentication (or 465 with implicit TLS) — those are the submission ports and are not blocked. If the server does not offer them, that is the server to fix, not the ISP.
Your cloud VM cannot deliver mail anywhere
Providers block outbound 25 on new accounts by default. Some lift it on request with justification; many will not. The practical answer for application mail is a relay service on 587 or an API, which also gives you the reputation, SPF alignment and DKIM signing that a fresh IP address does not have.
Check port 25 yourself
No browser can open a raw TCP socket, so no web page can honestly tell you whether this port is open on a remote host. These are the real commands, generated for port 25 — swap example.com for the host you are actually testing.
Is port 25 reachable on another host?
nc -vz example.com 25"succeeded!" means the TCP handshake completed — the port is open. "Connection refused" is closed; a hang until timeout means filtered (a firewall dropped it silently).
nmap -Pn -p 25 example.comThe only common tool that distinguishes open / closed / filtered. -Pn skips the ping sweep, so it still works against hosts that ignore ICMP.
Test-NetConnection example.com -Port 25Read TcpTestSucceeded: True = open. It is built in — nothing to install.
telnet example.com 25A blank screen or a banner means it connected. "Connection refused" means closed. Quit with Ctrl-] then `quit`.
curl -v --max-time 5 telnet://example.com:25Handy when telnet is not installed: "Connected to …" proves the TCP handshake, without curl trying to speak HTTP.
What on this machine is holding port 25?
sudo ss -tlnp | grep :25Lists the listening socket and the PID/program holding it. Drop sudo and you get the socket but not the process name.
sudo lsof -i :25The macOS answer to "address already in use". Kill it with `kill -9 <PID>` once you are sure what it is.
netstat -ano | findstr :25The last column is the PID. Match it in Task Manager’s Details tab, or `taskkill /PID <pid> /F`.
No web page can tell you whether a port is open on a remote host
A browser cannot open a raw TCP socket — there is no API for it, by design. So a site that reports “port 3389 is OPEN on 203.0.113.10” is not checking from your browser; it is asking its own server to scan on your behalf. That works, but it means their server sees the host you asked about, scans from their address rather than yours, and answers a question about their network path, not yours.
We don't have a server here and won't pretend to. So this page does three honest things instead:
| Port | Proto | Service | What it is | Exposure | |
|---|---|---|---|---|---|
| 25 | tcp | SMTP | Server-to-server mail delivery.Public only on a real mail exchanger — never an open relay, and never for client submission. | Carebrowser-blocked | |
| 2525 | tcp | SMTP alt | Mail submission where 25 and 587 are blocked.Same rules as 587: TLS and authentication. | Care | |
| 8025 | tcp | MailHog / Mailpit | Local mail-catcher web UI.Every test email your app sent, readable by anyone. | Never | |
| 8125 | udp | StatsD | Metrics ingestion.Unauthenticated; anyone can poison your dashboards. | Never | |
| 10250 | tcp | kubelet API | The Kubernetes node agent API.Anonymous access here means exec into any pod on the node. | Never | |
| 10255 | tcp | kubelet read-only | Deprecated unauthenticated kubelet port.Pod specs and environment variables — often including secrets. | Never | |
| 25565 | tcp | Minecraft Java | The Java-edition server port.Public game server: whitelist it, keep it patched (see Log4Shell), and isolate the host. | Care | |
| 25575 | tcp | Minecraft RCON | Remote console for a Minecraft server.Server console access, protected only by a shared password. | Never | |
| 26257 | tcp | CockroachDB | CockroachDB SQL and node traffic.Database plus cluster membership. | Never |
http://host:port/ and times it. A connection that is established proves a socket is open; an instant refusal usually means nothing is listening; anything else is honestly reported as “can't tell”. Each attempt gives up after 2.5s.nc -vz example.com 443
nmap -Pn -p 443 example.com
telnet example.com 443
curl -v --max-time 5 telnet://example.com:443
This page cannot answer that, and neither can any other page — from your browser. Opening a TCP connection to an arbitrary host and port is not something JavaScript is allowed to do. Every “open port checker” that gives you a green tick is running the scan on their server. Which is fine, as long as you know what you are agreeing to: they learn which host and port you were worried about, and the answer they give you is about the route from their data centre — not from the internet as your users see it.
What to do instead
Run the check from outside your own network. Copy an nmap or nc line from the card above and run it from a machine that is not behind the same router — a phone on mobile data with a terminal app, a cheap VPS, a colleague's laptop. Running it from inside the LAN tests the LAN, not the internet, and will happily say “open” while the world sees nothing.
Then check the thing that is actually blocking it, in this order: the service is bound to0.0.0.0 and not 127.0.0.1 · the host firewall (ufw, firewalld, Windows Defender Firewall) · the cloud security group or the router's port-forward rule · and finally your ISP, which commonly blocks 25, 80 and 445 on residential lines whatever you configure.
What a browser genuinely can verify
One thing: that an HTTPS service answers. If what you actually want to know is “is my site up and how fast is it”, the latency test measures real round trips to a CORS-open URL. If the name doesn't resolve, or resolves somewhere unexpected, that is a DNS problem, not a port problem — and it is the more common cause of “my port is closed” than an actual firewall.
An IP address finds the machine; a port picks which program on it gets the traffic. TCP sets up a connection first — a handshake, ordered delivery, retransmission — which is why the web, email and SSH use it. UDP just sends the packet with no handshake and no guarantee it arrives, which is why DNS, video calls and games use it: late data is worse than lost data.
That difference is why a UDP port is so much harder to test. TCP either completes a handshake or it doesn't, so a tool can tell you. A UDP service that has nothing to say to an unexpected packet stays silent — and silence looks identical to a firewall dropping it.
The three ranges
0–1023Assigned by IANA to core services. On Unix, binding one needs root (or CAP_NET_BIND_SERVICE).1024–49151Registered by vendors for their applications. Any user can bind these — which is why every dev server lives here.49152–65535Never assigned. The OS hands these out as the SOURCE port of your outgoing connections. (Linux actually uses 32768–60999 by default.)Closed is not the same as filtered
Closed means the host answered: the packet arrived, nothing is listening, and you got an immediate refusal (a TCP RST). Filtered means nothing answered at all — a firewall dropped your packet in silence, so you wait for a timeout and learn nothing. The difference matters: closed proves the host is reachable and the port is free; filtered tells you only that something between you and it is discarding traffic.nmap reports the two separately. A browser cannot distinguish them, which is why this page reports a timeout as “can't tell” rather than guessing.
The one habit worth keeping
Bind services to 127.0.0.1 instead of 0.0.0.0 unless something outside the machine genuinely needs them, and reach them over SSH or a VPN. Every database on the never-expose list above ships with that advice, and the leaks all begin the same way: a default bind address, a cloud instance with a public IP, and a scanner that found it within the hour.
The blocked-port list this page uses is the WHATWG Fetch Standard's “bad port” table — the ports every browser refuses to connect to (Chrome calls it ERR_UNSAFE_PORT). Local probing is additionally gated by Chrome's Local Network Access permission, which replaced Private Network Access and ships in Chrome 142.
FAQ
Should port 25 be open on my server?
Inbound, yes, if the server is a mail exchanger — that is how other servers deliver to you. Outbound, only if you actually send directly. What must never happen is accepting and forwarding mail from unauthenticated senders, which is an open relay.
Port 25 or 587 for sending?
587 for a mail client submitting a message, always — it is the submission port, it requires authentication, and it is not blocked by ISPs. 25 is exclusively for server-to-server transfer.
Is port 25 encrypted?
Opportunistically. STARTTLS upgrades a plain connection to TLS when both sides support it, but classic SMTP falls back to cleartext if the upgrade fails, which is what MTA-STS and DANE exist to prevent. Assume nothing about a given hop without checking.