Port reference
Port 2525 (TCP) – SMTP Submission (alternate)
Unofficial alternate SMTP submission port commonly used when standard mail ports (25/587/465) are blocked.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Not an official mail port, but widely supported by mail providers as a fallback when 25/587 are blocked.
What is port 2525 used for?
Port 2525 is a non-standard alternate port for SMTP mail submission. It carries the same protocol as the official outgoing-mail ports — 25, 587, and 465 — but on a number not reserved by IANA. Email providers like SendGrid, Mailgun, and Mailtrap, along with many hosting platforms, offer 2525 as a fallback so apps and mail clients can still send authenticated email when a network or ISP blocks the standard ports.
When would you open it?
You use 2525 when sending outbound email and ports 25 or 587 are blocked — common on cloud platforms and some home/ISP connections. You configure it in your mail client or app's SMTP settings; on a mail server you would enable it only if you want to offer this fallback to your users.
Is it safe to open?
It is as safe as 587 when set up the same way: require SMTP authentication and STARTTLS, and never run an open relay. The port number itself adds no protection. See the security notes below.
How to check if this port is open
ss -tulpn | grep :2525
nmap -p 2525 <target>netstat -ano | findstr :2525
Test-NetConnection <host> -Port 2525lsof -i :2525
nmap -p 2525 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 2525 to your device's local IP, internal port 2525, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 2525/tcpsudo firewall-cmd --permanent --add-port=2525/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2525 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 2525" -Direction Inbound -Protocol TCP -LocalPort 2525 -Action AllowSecurity & risks
Common attacks
- Credential brute force against SMTP authentication
- Spam relay abuse through misconfigured or open submission
- Credential capture if STARTTLS is not enforced
- Reconnaissance of mail server capabilities via SMTP commands
Hardening
- Require SMTP AUTH and enforce STARTTLS (or implicit TLS) on submission
- Never run as an open relay — restrict to authenticated senders
- Rate-limit and lock out repeated failed logins
- Keep the MTA patched and monitor for unusual send volumes
How to block this port
sudo ufw deny 2525/tcpsudo firewall-cmd --permanent --remove-port=2525/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2525 -j DROPNew-NetFirewallRule -DisplayName "Block 2525" -Direction Inbound -Protocol TCP -LocalPort 2525 -Action Blocknmap snippet
nmap -p2525 --script smtp-commands,smtp-open-relay <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why use port 2525 instead of 587?
- Port 2525 is a non-standard alternative used when ISPs or networks block the official submission ports 25 and 587. Many providers support it as a fallback so clients can still send authenticated mail.
- Is port 2525 secure?
- It can be, if you require SMTP AUTH and STARTTLS just as you would on 587. The port number alone provides no security — it is the same submission protocol on a different number.