Email Connection Timed Out on Port 25: Blocked Outbound SMTP

If your server queues mail and logs Connection timed out toward remote servers on port 25, outbound SMTP is almost certainly being dropped somewhere between you and the internet. Port 25 is the port mail servers use to deliver to each other, and because it is also the favorite channel for spam from infected machines, many hosts, cloud platforms and ISPs block or restrict it by default.

A typical Postfix log line looks like this:

postfix/smtp[2841]: connect to mx.example.net[198.51.100.25]:25: Connection timed out
postfix/smtp[2841]: 8A1F32C4: to=<a@example.net>, relay=none, delay=30, status=deferred

The word deferred matters: Postfix will retry for days, so the failure shows up as delay, not an immediate bounce. A timeout is different from Connection refused, which means something answered and rejected you. A timeout means packets vanished, which fits a firewall that silently drops traffic.

Step 1: prove it is port 25 and outbound

From the sending server, test a known-good mail server on port 25 and on 587:

nc -vz -w 8 gmail-smtp-in.l.google.com 25
nc -vz -w 8 smtp.gmail.com 587

If 587 connects and 25 times out, you have found it. The pattern also helps rule out DNS failure, since both commands resolve a hostname. If neither connects, the problem is more general: check basic outbound connectivity, DNS resolution (dig example.com), and local rules with sudo iptables -S OUTPUT or sudo ufw status verbose.

Note that this is the reverse of the usual port-check. Our Port Checker tests whether a port is reachable to a host from the internet, which covers inbound port 25 on your own server. Outbound blocking has to be tested from the server itself.

Also confirm the recipient domain actually has mail servers with the MX Lookup. A bad MX target also produces timeouts.

Step 2: find who is blocking

Check in this order:

1. Your cloud provider. Several large providers restrict outbound port 25 on new or standard accounts, for example by throttling it or blocking it until you request removal. Policies change, so look for "port 25" in your provider's current documentation and support portal.
2. Your local firewall. An OUTPUT rule, a security group or a network ACL denying 25.
3. A residential or business ISP. Home connections routinely block outbound 25. This matters if the mail server is on a home network or office line.
4. Your own network gear. Corporate firewalls often allow only a mail gateway to speak SMTP.

If you are on a managed host, the answer is often a support ticket asking to lift the restriction. Be ready to describe your use case and how you handle abuse.

Step 3: send through a relay on port 587

For application mail (password resets, receipts, alerts), you rarely need direct delivery. Relay through an authenticated provider on port 587 with STARTTLS, or 465 with implicit TLS, which are generally not blocked. In Postfix:

## /etc/postfix/main.cf
relayhost = [smtp.provider.example]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt

Create /etc/postfix/sasl_passwd with [smtp.provider.example]:587 username:password, then run sudo postmap /etc/postfix/sasl_passwd && sudo chmod 600 /etc/postfix/sasl_passwd* && sudo systemctl reload postfix. Your provider's documentation gives the exact host and credentials. If login fails, see SMTP 535 authentication failed.

Step 4: if you must deliver directly

Running your own outbound mail requires an IP that is allowed to send, a PTR record matching your HELO name, and SPF, DKIM and DMARC. Ask the host to unblock 25, then verify DNS with the Email DNS Checker and read reverse DNS for email. Check the IP's reputation with the Blacklist Checker and confirm your public address with What Is My IP.

Rule out the other timeouts

• The remote server is down or slow. Test a few unrelated destinations. If only one domain times out, the problem is theirs.
• IPv6 failure. If the destination has AAAA records and your IPv6 route is broken, set inet_protocols = ipv4 in Postfix as a test.
• Tarpitting or greylisting. Slow or temporary rejections look different, with an actual SMTP reply such as 421 or 450.

Verify

Flush the queue (sudo postqueue -f), watch tail -f /var/log/mail.log, and expect status=sent. Then run the Email Deliverability Test to check how the message arrives.

Next steps

• Review connection refused, timed out and reset to tell the failure types apart.
• Read WordPress email not sending if the sender is a CMS.
• Set up a transactional email DNS checklist.
• Handle SMTP 421 service not available if the server answers but refuses.

FAQ

Is port 25 blocked everywhere?

No, but it is restricted by many consumer ISPs and several cloud platforms by default. Whether your server is affected depends on your provider's current policy.

Does port 587 work if 25 is blocked?

Usually yes, since 587 is the standard submission port for authenticated senders. You need a relay or provider that accepts connections on it.

Will blocked port 25 stop me receiving mail?

Outbound blocking does not affect inbound delivery. Receiving needs inbound port 25 open on your server, which you can check with the Port Checker.

Why does mail show deferred instead of bounced?

Timeouts are temporary-looking failures, so the server retries for several days before giving up and generating a bounce.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.