Port 25 and Outbound Mail From Cloud Servers

Port 25 is the port mail servers use to deliver mail to one another. Nearly every cloud provider blocks outbound traffic on it by default, and a request to lift that restriction is one of the more common support conversations in cloud hosting.

Why it is blocked

Cloud servers are cheap, fast to create and easy to automate, which makes them attractive to people sending unsolicited mail in volume. If a provider allowed unrestricted outbound port 25, its address ranges would rapidly appear on blocklists, and that damage falls on every legitimate customer in the same ranges.

Blocking by default and lifting on request is how providers keep their ranges reputable. The restriction protects the provider’s other customers, which includes you.

How the approval process usually works

The pattern is consistent across providers: you open a support request describing what you intend to send, to whom, and roughly in what volume. Accounts with some history and a verified billing relationship are treated more readily than brand-new ones, for obvious reasons.

An account that already carries the permission has been through that process. That is what the open port 25 configurations in the catalogue describe, including options under Hetzner, DigitalOcean, Kamatera, OVHcloud and Linode. The permission remains subject to the provider’s acceptable-use policy, and providers can and do withdraw it where mail practices cause problems.

Whether you actually need it

Most applications that send mail do not need port 25 open. Transactional mail — password resets, receipts, notifications — is usually sent through a relay or mail service over ports 587 or 465, which are not restricted. The relay handles delivery, reputation and authentication.

You need outbound port 25 when your server is itself acting as a mail server delivering directly to recipient servers: running your own mail domain, operating an internal relay, or testing mail-handling software end to end.

Delivery is not just a port

Opening the port is the smallest part of getting mail delivered. Receiving servers assess reputation, and the technical requirements are non-negotiable in practice:

• SPF — a DNS record declaring which hosts may send for your domain.
• DKIM — a cryptographic signature on outgoing mail.
• DMARC — a policy telling receivers what to do when checks fail.
• Reverse DNS — the sending address resolving back to a matching hostname.
• Address reputation — built slowly, damaged quickly.

A server with port 25 open and none of these will have its mail rejected or filed as spam. Conversely, a well-configured relay needs none of your own port 25 access.

A reasonable decision rule

If you are sending application mail, use a relay. If you are operating mail infrastructure as the product, you need the port and everything above it. Choosing the first option is not a compromise; it is what most production systems do.

DNS record setup is covered in DNS basics for cloud-hosted applications.