Port 25 blocked by your cloud provider? How to send mail anyway

If port 25 is blocked on your VPS, your mail server can still receive email, but it cannot hand outgoing mail to Gmail, Outlook or any other server, because server-to-server delivery uses outbound TCP port 25. You have two real fixes: ask your cloud provider to lift the block (possible on Vultr, Linode, Hetzner, AWS, Oracle and some Azure subscriptions), or send through an SMTP relay on port 587 or 2525, which works even where the block is permanent.

This article shows how to confirm the block, what each major provider says about it in its own documentation, and how to choose between an unblock request and a relay. If you are setting up mail from scratch, start with our guide to running an email server on a VPS.

Why cloud providers block port 25

Port 25 is the port mail servers use to talk to each other. A new VPS costs a few dollars and can be created in a minute, which makes it attractive for spammers. When one customer sends spam, the provider's whole IP range can end up on blocklists, and every other customer's mail suffers. Blocking outbound port 25 by default, then opening it for customers who ask and look legitimate, is how most providers protect their IP reputation.

Two details are worth knowing:

• Only outbound traffic is blocked. Other servers can still connect to your port 25, so incoming mail keeps arriving. That is why the problem often goes unnoticed for days: you receive mail, but your replies never leave the queue.
• Ports 465 and 587 are different. They are submission ports, used by mail clients and relays with a login. Several providers leave them open, but not all.

How to check whether port 25 is blocked

Run this from the server. It tries to open a TCP connection to Gmail's inbound mail server:

nc -vz -w 5 gmail-smtp-in.l.google.com 25

A line ending in succeeded or open means outbound port 25 works. A timeout means something is dropping the traffic, almost always the provider. If nc is not installed, use Bash's built-in TCP support:

timeout 5 bash -c '</dev/tcp/gmail-smtp-in.l.google.com/25' && echo open || echo blocked

Test 587 the same way to see whether a relay will work. Also look at your mail queue (postqueue -p on Postfix): messages piling up with Connection timed out next to remote servers are the classic symptom.

Check this before you spend time on SPF, DKIM or DMARC. A blocked port and a spam problem look different: with a block, mail never leaves; with a reputation problem, mail leaves and lands in spam. For the second case, see why emails go to spam.

Port 25 policies by cloud provider

Policies change, so check the linked page before you rely on it. This is what each provider's documentation said at the time of writing (October 2026).

Provider	Outbound 25	Ports 465 / 587	Can you get it unblocked?	Official source
DigitalOcean	Blocked on all Droplets	Also blocked	No unblock process documented; DigitalOcean recommends a third-party email service	Why is SMTP blocked?
Vultr	Blocked on new instances	Open	Support ticket with your use case, anti-spam measures and volume; reviewed case by case, not guaranteed	Why is SMTP blocked?
Linode (Akamai)	Restricted on some accounts created after 5 November 2019	Also restricted	Contact Support and ask for the restriction to be lifted	Send email
Hetzner Cloud	25 and 465 blocked by default	587 open	Limit request after one month as a customer and your first paid invoice	Cloud server FAQ
AWS EC2	Blocked by default	Not part of the restriction	Submit the request form, once per Region	EC2 port 25
Google Cloud	Blocked to external destinations (some projects exempt)	Not restricted	No unblock process documented; use a relay on 465 or 587	Sending email from an instance
Microsoft Azure	Open for Enterprise Agreement and MCA-E; blocked for other types	Authenticated 587 not restricted	Enterprise Dev/Test can request an exemption in Diagnose and solve problems	Troubleshoot outbound SMTP
Oracle Cloud	Blocked for tenancies created after 23 June 2021	Not covered by the note	Service limits request for an exemption	Release note

A few provider details that save time:

• DigitalOcean blocks 587 too, so a relay on 587 will not work there. Use a relay that offers another port: SendGrid lists 25, 587, 2525 and 465 in its SMTP documentation, and Mailgun listens on 25, 465, 587 and 2525 (Mailgun SMTP docs).
• Hetzner will not open the port during your first month, so plan a relay for launch even if you intend to ask later.
• AWS has a separate process for Lightsail (Lightsail port 25). AWS itself suggests Amazon SES as the alternative.
• Azure only promises an open port, not delivery: Microsoft notes that external domains may still reject mail from VMs.

Vietnamese and other local VPS providers vary by provider and by plan. Ask before you order: is outbound port 25 open, how do you request it, and can they set reverse DNS (PTR) for the IP? Our cloud provider install notes list the questions to ask.

Option 1: Ask the provider to unblock port 25

If you want to run a full mail server that delivers directly, an unblock is the cleanest result. Providers decide case by case, so make the request easy to approve:

1. Set up DNS first. Create an A record for your mail hostname (for example mail.example.com) and set reverse DNS (PTR) for the IP to that name. Linode explicitly asks for this before you open the ticket. Our guide to reverse DNS for mail servers covers PTR on each provider.
2. Publish SPF, DKIM and DMARC for the sending domains.
3. Describe the use case in plain words. "Business mailboxes for 12 staff and transactional mail from our shop, about 300 messages a day" is better than "I need port 25."
4. Explain your anti-spam controls. Per-account sending limits, rate limiting, no open relay, and how you handle abuse reports. Vultr asks for exactly this.
5. Be patient and polite. A refusal is not always final; a later request from an older account with paid invoices often goes through.

Approval is never guaranteed, and on DigitalOcean and Google Cloud there is no documented path at all.

Option 2: Send through an SMTP relay (smarthost)

A relay, also called a smarthost, is a mail service that accepts your outgoing mail on an authenticated submission port and delivers it from its own IPs. Your server keeps its mailboxes, webmail, IMAP and incoming mail; only the last hop of outgoing mail changes. Common choices include SendGrid, Mailgun, Amazon SES and Brevo. Compare their current pricing and free tiers on each vendor's site, since they change often.

What to set up with a relay:

Step	Why
Verify your sending domain with the relay	The relay will only send for domains you prove you own
Add the relay to your SPF record (usually an include:)	Receivers check that the relay's IPs may send for your domain
Publish the relay's DKIM records, or keep your own DKIM signature	Keeps DKIM aligned with your From domain, which DMARC needs
Use port 587 with STARTTLS (or 2525 where 587 is blocked)	Authenticated submission, not blocked by most providers
Keep per-account sending limits on your server	A hacked site will otherwise burn your relay account

Trade-offs, honestly: a relay adds a monthly cost once you pass its free tier, puts another company between you and your recipients, and has its own sending limits and acceptable use policy. In return, you get a sending IP with an established reputation, which often improves inbox placement on a fresh VPS. Reverse DNS on your own IP matters less for outgoing mail in this setup, since recipients see the relay's IP, though you should still set it.

Option 3: Keep mailboxes elsewhere

If you do not need mail on the server at all, point the domain's MX records to a hosted provider such as Google Workspace, Microsoft 365 or Zoho Mail, and use the server only for websites. Website mail (contact forms, WooCommerce orders) can then go out through that provider's SMTP or a transactional relay. This is the simplest route when you host a handful of company domains and do not resell email.

How ZoPanel handles a blocked port 25

ZoPanel's mail server (Postfix, Dovecot and Rspamd) detects a blocked outbound port 25 and warns you on the Email page: incoming mail works, but delivery to other servers fails until you act. Mail delivery check tests outbound port 25 and PTR alongside MX, SPF, DKIM and DMARC, so you can see the cause in one place.

If the provider will not open the port, configure Outgoing mail relay (smarthost) on the Email page with SendGrid, Mailgun, Amazon SES, Brevo or another service. It uses port 587 unless you set another port, which matters on DigitalOcean. Mail from websites and mailboxes still passes through the server first, where the per-account Sending limits count every recipient, so one hacked site cannot exhaust your relay. Details are in the email docs, and the cloud provider notes list firewall ports and PTR steps per provider.

What ZoPanel cannot do: open the port for you, or make a provider approve your request. Like every panel, it can only work around the block. See the full mail feature list on the email features page.

Conclusion

A blocked port 25 is normal on cloud VPS providers, not a sign that something is broken. Test it with one command, then pick a path: request an unblock if your provider offers one and you want direct delivery, or use a relay on 587 (or 2525 on DigitalOcean) if you want mail working today. Either way, set PTR, SPF, DKIM and DMARC, because Gmail and Outlook check them no matter which IP delivers the message.

To try this on your own server, ZoPanel's Free plan includes the mail server, Mail delivery check and the smarthost setting, with 3 hosting accounts and 10 websites and no time limit.

Frequently asked questions

How do I know if my VPS blocks port 25?

Run nc -vz -w 5 gmail-smtp-in.l.google.com 25 on the server. A timeout means outbound port 25 is blocked, usually by the provider. Messages stuck in the mail queue with "Connection timed out" are another sign.

Can I just use port 587 instead of port 25 to deliver mail?

Not directly. Other mail servers accept incoming mail on port 25 only; 587 is a submission port that needs a login. You can use 587 to hand mail to a relay you have an account with, and the relay then delivers it on port 25 from its own servers.

Does a blocked port 25 stop incoming mail?

No. Providers block outbound connections to port 25. Other servers can still connect to your server on port 25, so mail to your mailboxes keeps arriving as long as your MX records point to it.

Which VPS providers allow port 25?

On request, Vultr, Linode, Hetzner (after your first month and paid invoice), AWS and Oracle can lift the block, and Azure leaves it open for Enterprise Agreement and MCA-E subscriptions. DigitalOcean and Google Cloud document no unblock process. Smaller providers each have their own policy, so ask before you order.

Is an SMTP relay worse than sending directly?

Not for deliverability: a relay's IPs usually have a better reputation than a new VPS IP. The downsides are cost beyond the free tier, the relay's own limits and policies, and one more company handling your mail.