Port reference
Port 25 (TCP) – SMTP
Server-to-server email transfer protocol used to relay and deliver mail between MTAs.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on mail servers (MTAs) accepting inbound mail; usually exposed to the internet for delivery.
What is port 25 used for?
Port 25 is the default port for SMTP (Simple Mail Transfer Protocol), used by mail servers to relay and deliver email to each other. When one mail server (MTA) hands a message to the next on its way to the recipient, that exchange happens on port 25. The software involved is mail server programs like Postfix, Exim, Sendmail, and Microsoft Exchange. Mail apps sending your outgoing messages use port 587 or 465 instead, not 25.
When would you open it?
Open port 25 when you run your own mail server that must receive email from the internet, for example self-hosting mail for a domain. Many home ISPs and cloud providers block it to fight spam. Only open it if you actually operate a mail server that needs to accept inbound delivery.
Is it safe to open?
The main risk is becoming an open relay or being spoofed, so accept mail only for your own domains, publish SPF/DKIM/DMARC, and keep the server patched. See the security notes below.
How to check if this port is open
ss -tulpn | grep :25
nmap -p 25 <target>netstat -ano | findstr :25
Test-NetConnection <host> -Port 25lsof -i :25
nmap -p 25 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 25 to your device's local IP, internal port 25, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 25/tcpsudo firewall-cmd --permanent --add-port=25/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 25 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 25" -Direction Inbound -Protocol TCP -LocalPort 25 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Open relay abuse for spam and phishing
- Sender spoofing where SPF/DKIM/DMARC are missing
- User/address enumeration via VRFY, EXPN, and RCPT probing
- STARTTLS stripping and downgrade to cleartext
Hardening
- Never run an open relay; require authentication for client mail submission
- Use port 587 (submission) with STARTTLS for authenticated clients
- Publish and enforce SPF, DKIM, and DMARC; enable MTA-STS
- Disable VRFY/EXPN and rate-limit connections
How to block this port
sudo ufw deny 25/tcpsudo firewall-cmd --permanent --remove-port=25/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 25 -j DROPNew-NetFirewallRule -DisplayName "Block 25" -Direction Inbound -Protocol TCP -LocalPort 25 -Action Blocknmap snippet
nmap -p25 --script smtp-commands,smtp-open-relay,smtp-enum-users,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 25 and 587?
- Port 25 is for server-to-server mail relay (MTA to MTA). Port 587 is the authenticated submission port used by mail clients to send outgoing mail, and should require login and STARTTLS.
- Why is port 25 often blocked?
- Many ISPs and cloud providers block outbound port 25 to curb spam from compromised hosts and open relays. Legitimate clients should submit mail on port 587 instead.