Outbound port 25 on cloud servers, and what providers allow

You deploy a server, install a mail transfer agent, send a test message, and nothing arrives. There is no error in the logs beyond a connection timeout. This is not a misconfiguration. It is your provider blocking outbound port 25, and nearly all of them do it.

Why the outbound port 25 block exists

Direct SMTP delivery works by connecting to a recipient’s mail server on port 25 and handing over the message. That is how internet mail has always worked, and it requires no authentication and no relationship with the recipient.

Cheap cloud instances that can be created in seconds and paid for with a stolen card are, from a spammer’s point of view, perfect. If providers allowed unrestricted outbound SMTP, their IP ranges would land on blocklists within days, and every legitimate customer sharing those ranges would suffer.

So the default is closed, and access is a request rather than a right. This is a good policy, even when it is inconvenient.

What the major providers do

AWS. Throttles outbound port 25 on EC2 by default. Removal is requested through a form and is usually tied to a reverse DNS record on your Elastic IP. AWS also runs its own sending service, which is the route it prefers you to take.

Google Cloud. Blocks outbound port 25 from Compute Engine and does not lift it. The documented answer is to use a relay or an email service provider on port 587 or over an API.

Azure. Blocks outbound port 25 from virtual machines on most subscription types and generally does not lift it for pay as you go accounts. Relays and email services are the supported path.

DigitalOcean, Linode, Hetzner, OVHcloud, Vultr, UpCloud and similar. Block by default on new accounts and lift on request once the account is established, usually with a short explanation of the use case. This is the group where an account with the port already open has real practical value, because the waiting and the review are already done.

Oracle Cloud. Blocks by default and reviews requests.

Policies change, so treat the above as the shape rather than the letter. The consistent pattern is that no reputable provider hands port 25 to a brand new account.

Do you actually need it?

This is the question worth answering before you go looking for an account with port 25 open.

You do not need port 25 if you are sending application mail: password resets, receipts, notifications, newsletters. Sending through a relay on port 587 or through an HTTPS API gives you better deliverability than you would achieve yourself, because the relay operator maintains IP reputation, handles bounces, signs messages and manages feedback loops. That is a full time job you probably do not want.

You do need port 25 if you are running a mail server that receives and delivers mail directly, operating a mail gateway or filter, running a mailing list system that delivers itself, or building something where the SMTP conversation with the destination server is the product.

For most application developers, the honest answer is that a relay is both easier and more effective. For anyone genuinely operating mail infrastructure, there is no substitute.

If you do need it, do it properly

An IP address with an open port 25 and nothing else configured will have its mail rejected or filed as spam. The minimum viable setup:

1. A dedicated IP with a matching reverse DNS record. The PTR record must resolve to a hostname that resolves back to the same address. Most providers let you set this, and most receiving servers check it.
2. SPF, DKIM and DMARC. All three, published correctly. The detail is in SPF, DKIM and DMARC explained.
3. A clean IP. Check the address against the major blocklists before you send anything. Cloud IP ranges are recycled, and you may inherit somebody else’s history.
4. Gradual warm up. Sending volume from a new address should ramp over days, not start at full rate.
5. Working postmaster and abuse addresses. Both are expected to exist and be read.
6. Real bounce handling. Continuing to send to addresses that hard bounce is the fastest way onto a blocklist.

Choosing an account for mail work

If mail delivery is the point of the project, the account level SMTP policy is the specification, not a detail. Three things to confirm:

• Whether port 25 is open on the account, or whether you will be filing a request.
• Whether you can set reverse DNS on the address you will be sending from.
• Whether the provider’s IP ranges have a reasonable reputation for the destinations you care about.

Provider by provider detail is in the DigitalOcean guide, the Hetzner guide, the Linode guide and the OVHcloud guide.