Port 25 SMTP – Free, Online, Private

What listens on 25

Port 25 is SMTP between mail servers. The IANA name is smtp, Simple Mail Transfer. A sending host looks up the recipient's MX and connects to that host on 25. The conversation is a series of commands, EHLO, MAIL FROM, RCPT TO, DATA, and it may upgrade to TLS with STARTTLS. It is not the port a user's mail application should use to send mail through their provider. That is submission, port 587, or submissions, port 465. Blocking outbound 25 from end-user networks is normal, because compromised machines send spam there.

The IANA service name is smtp: Simple Mail Transfer. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 25. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 25

Service notes for port 25: the IANA name is smtp (Simple Mail Transfer), and the program people mean is SMTP. TCP 25 is the IANA smtp port for server-to-server mail transfer. User clients should submit on 587 or 465, not here. An open relay on 25 will be found and used. Require authentication for any mail that is not destined to a domain you host, and even then prefer that users submit on 587. STARTTLS on 25 is opportunistic. A network attacker can strip it unless the sender demands TLS. Do not put an admin interface on this port. Do not leave a test server that accepts every recipient. If you do not run mail, nothing should listen, and outbound 25 from the server should be blocked unless this host is a mail exchanger you meant to operate. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 25, you are on the wrong page.

The usual production bug is an application server that tries to deliver mail directly to the internet on 25 and fails because the cloud provider blocks it. Use a submission service on 587. A second bug is a firewall that allows 25 and not 587, so the server can receive and the users cannot send. A third is a listener on 25 that is an old Postfix test with inet_interfaces set wrong, accepting mail on a public address you thought was internal. ss shows the address. Read it.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 25 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. A mail exchanger should show a listener on 25 on the public address, and a connection from outside should receive a 220 banner. A timeout means the provider or your firewall is filtering SMTP. A banner from a host you do not recognize means you are not talking to your server.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• Port 25 is transfer. Port 587 is submission. Mixing them up is how a laptop tries to send mail and gets rejected.
• STARTTLS on 25 is not the same as implicit TLS on 465.
• A 220 banner proves a mail server answered. It does not prove it will accept mail for your domain.
• UDP 25 exists in the registry and is not how SMTP works.

Linuxsudo ss -lptn 'sport = :25'
sudo lsof -nP -iTCP:25 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:25 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.25[^0-9]'

Windowsnetstat -ano | findstr :25
Get-NetTCPConnection -LocalPort 25

Remotenc -vz host 25