If you have tried to send mail directly from a cloud server and watched every connection time out, you have met the default outbound block on port 25. It is one of the most common surprises for people moving mail workloads into the cloud, and it is deliberate.
Why providers block it
Port 25 is the port mail servers use to talk to each other. It is also the port a compromised server uses to send spam. Because a cloud provider’s IP ranges are shared reputation space, a single abusive customer can get entire blocks listed on anti-spam services, which damages deliverability for everyone else on those ranges.
Blocking outbound port 25 by default is the cheapest way for a provider to protect that reputation. Ports 587 and 465, used for authenticated submission to a relay, are normally left open, because those paths involve an authenticated account somewhere that can be held responsible.
Which providers block it
| Provider | Default outbound port 25 |
|---|---|
| DigitalOcean | Blocked by default on new accounts |
| Linode (Akamai) | Blocked by default on new accounts |
| OVHcloud | Restricted by default |
| Hetzner | Restricted by default |
| Kamatera | Restricted by default |
| AWS | Throttled by default, with SES as the intended path |
| Google Cloud | Blocked, with no removal path for most customers |
The pattern is consistent: the block is the default everywhere, and the difference between platforms is whether it can be lifted at all.
What an open port 25 account changes
An account listed with port 25 open has that outbound restriction removed. Your server can open direct SMTP connections to receiving mail servers, which is what you need if you are running a mail transfer agent, a mail server appliance, or software that talks SMTP directly rather than through a relay.
What it does not do is make your mail arrive. Deliverability depends on things the port block has nothing to do with:
- Reverse DNS that matches your sending hostname.
- SPF records authorising the sending IP.
- DKIM signing so receivers can verify the message.
- DMARC policy tying the two together.
- IP reputation, which starts neutral at best and has to be warmed.
An open port with no reverse DNS and no authentication records will get your mail rejected just as thoroughly as a blocked port, only later in the process.
When to use a relay instead
For most applications sending transactional mail, a relay is the better answer. You connect to a service on port 587 with credentials, and the service handles reputation, authentication and retry logic. Amazon SES is the obvious example: it exists precisely so you do not have to run your own mail infrastructure on a cloud IP.
Use a relay when:
- You are sending application mail such as receipts, password resets or notifications.
- You do not want to own IP reputation management.
- Volume is moderate and predictable.
Use direct port 25 when:
- You are running an actual mail server that must receive and relay mail.
- You are operating a mail appliance or gateway that speaks SMTP natively.
- You have a specific reason to control the sending path end to end.
A practical setup order
If you have decided direct sending is right, do these in order before sending anything real:
- Confirm outbound port 25 is genuinely open from the server.
- Set reverse DNS on the IP to match your mail hostname.
- Publish SPF for the sending IP.
- Configure DKIM signing and publish the public key.
- Publish a DMARC record, starting in monitoring mode.
- Warm the IP gradually rather than sending at full volume on day one.
Common questions
Can I get port 25 unblocked on a standard account?
It varies. Some providers will consider a request with a justification and an account history; others will not lift it at all. Accounts sold with port 25 already open exist because the request path is slow or closed on several platforms.
Does an open port 25 guarantee inbox placement?
No. It removes one blocker. Authentication records and IP reputation determine whether mail is accepted.
Should I send bulk marketing mail this way?
Generally no. Bulk sending from a fresh cloud IP is the fastest route to a blocklist. Use a service built for it.