SMTP Port 25 on Cloud Servers: Which Providers Block It and How to Send Email Properly
Why DigitalOcean, Linode, Hetzner, UpCloud, OVHcloud and Alibaba Cloud restrict outbound SMTP, how their unblock processes differ, what Kamatera does instead, and the reliable ways to send email from any cloud server.
The first time an application on a fresh cloud server tries to send email and the connection just hangs, most people assume a firewall mistake. Usually it is not. Nearly every cloud provider blocks outbound SMTP port 25 on new accounts, and several block the submission ports too. This guide explains why, compares the policies of seven providers, and lays out the ways that actually work for sending email from cloud infrastructure.
Why providers block port 25 #
Port 25 is the port mail servers use to talk to each other. A cloud server that can open connections on port 25 to any address in the world is, from a spammer’s point of view, a disposable mail cannon. Providers learned that lesson years ago: a small number of abusive customers got entire IP ranges listed on spam blocklists, which then hurt every legitimate customer sharing those ranges. Self-hosted mail servers are also hard to secure and easy to turn into open relays by accident.
Blocking outbound port 25 by default, and lifting the block only for customers who ask and explain, protects the reputation of the provider’s address space. Ports 465 and 587 are the ports clients use to hand mail to their own mail server with authentication; some providers block those on new accounts as well, others leave them open.
Provider policies compared #
The table summarizes each provider’s documented policy at the time of writing. Policies change, so treat the official documentation linked in each provider guide as authoritative.
| Provider | Default policy | How to get access |
|---|---|---|
| DigitalOcean | Ports 25, 465 and 587 blocked on all Droplets | Support ticket; granted case by case for established accounts with a clear use case, not guaranteed. Recommended: email API providers, or port 2525 where supported |
| Linode (Akamai Cloud) | Ports 25, 465 and 587 blocked on some new accounts | Support ticket describing the use case, or an email API provider |
| Hetzner | Ports 25 and 465 blocked on all cloud servers; port 587 open | After one month and a paid invoice, request an unblock with justification. Authenticated relays on 587 work immediately |
| UpCloud | Port 25 closed on all new accounts; blocked both ways during the trial | Contact support with identity verification, a payment method and the use case |
| OVHcloud | Unauthenticated sending on port 25 through OVHcloud’s outgoing server disabled by default on access products delivered after October 2024 | Setting can be changed in the Control Panel where applicable; authenticated sending is the norm |
| Alibaba Cloud | Port 25 disabled by default on ECS | Use port 465 with SSL to an authenticated service, or an email API |
| Kamatera | Port 25 not restricted by default | No request needed; responsible sending practices still apply |
The big three behave similarly to the first group: AWS throttles port 25 from EC2 by default and offers a removal request form, Google Cloud blocks outbound port 25 from Compute Engine, and Azure restricts it on most subscription types. Our Amazon SES guide covers the AWS side.
What “port 25 open” listings get wrong #
Searches for a provider name plus “port 25 open” turn up offers of pre-configured accounts. They are worth understanding for what they are not. On every provider in the table except Kamatera, the block is applied per account and lifted only after the provider reviews the account holder’s identity, payment history and stated use. An unblock granted to one person for one use case is not a property that can be handed to someone else; when the sending pattern changes, providers re-block and typically close the account. Design around the policy instead, using one of the approaches below.
Reliable ways to send email from a cloud server #
1. Use a transactional email service over its API
Amazon SES, SendGrid, Mailgun, Postmark and similar services accept mail over HTTPS, which no provider blocks. They also handle IP reputation, feedback loops and bounce processing, which is most of the work of running mail. This is the recommended path for nearly every application. Our Amazon SES guide walks through the setup and pricing.
2. Relay through an authenticated submission port
If your application or control panel only speaks SMTP, point it at your email service’s SMTP endpoint on port 587 (or 465 with TLS, or 2525 where offered) with a username and password. This works on Hetzner from day one, and on any provider that leaves the submission ports open.
3. Request an unblock for a real mail server
If you genuinely need to run your own mail server, open the support request the provider documents, explain the use case, and expect to show a paid history first. Then do the work that keeps the unblock: reverse DNS, authentication records, rate limits and bounce handling.
Whichever route you take: authenticate and monitor #
- Publish SPF, DKIM and DMARC records for every sending domain.
- Set reverse DNS on any IP that sends directly, matching the mail server hostname.
- Monitor bounce and complaint rates and remove addresses that fail.
- Rate-limit outbound mail so a compromised web form cannot burst spam.
- Send only to recipients who asked for your mail. Every provider’s acceptable use policy prohibits unsolicited bulk email, open port or not.
Diagnosing a blocked port #
Before opening a support ticket, confirm the block is the provider’s and not your own firewall. From the server, try a plain TCP connection to a known mail server on port 25 (for example with nc -vz or telnet against a well-known MX host) and then the same on port 587. A timeout on 25 with a connection on 587 is the signature of a provider-level block. Also check the server’s own firewall (ufw, firewalld or iptables) and any cloud firewall attached to the instance, since either can block outbound traffic independently.
Official references #
Each provider documents its policy: see the DigitalOcean docs, the Akamai Cloud docs, the Hetzner docs, the UpCloud docs, the OVHcloud help center and the Alibaba Cloud docs.
Frequently asked questions #
Can I send email from a DigitalOcean Droplet?
Not over SMTP by default; ports 25, 465 and 587 are blocked. Use an email API provider, ask support for a case-by-case unblock, or use port 2525 if your email provider supports it.
Which provider leaves port 587 open?
Hetzner blocks 25 and 465 but leaves 587 open, so an authenticated relay works immediately. Kamatera leaves port 25 itself unrestricted.
Is an “open port 25” account a shortcut?
No. Unblocks are tied to the reviewed account holder and are withdrawn when sending patterns change. Use an email service or request an unblock on your own account.
