Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I setup a MX mail server, everything works despite port 25 being blocked, I'm stumped as to why I am able to receive email with this setup, and what the consequences might be if I leave it this way. Here are the details:

  • Connections to SMTP over port 25 and 587 both reliably connect over my local network.
  • Connections to SMTP over port 25 are blocked from external IPs (the ISP is blocking the port).
  • Connections to Submission SMTP over port 587 from external IPs are reliable.
  • Emails sent from gmail, yahoo, and a few other addresses all are being delivered. I haven't found an email provider that fails to deliver mail to my MX.

So, with port 25 blocked, I am assuming other MTA servers fallback to port 587, otherwise I can't imagine how the mail is received. I know port 25 shouldn't be blocked, but so far it works. Are there mail servers that this will not work with? Where can I find more about how this is working?

-- edit

More technical detail, to validate that I'm not missing something silly. Obviously in the transcript below I've replaced my actual domain with

# DNS MX record points to the A record.
$ dig MX +short
$ dig A +short
<Public IP address>

# From a public server (not my ISP hosting the mail server)
# We see port 25 is blocked, but port 587 is open
$ telnet 25
Trying <public ip>...
telnet: Unable to connect to remote host: Connection refused
# Let's try openssl
$ openssl s_client -starttls smtp -crlf -connect
connect: Connection refused

# Again from a public server, we see port 587 is open
$ telnet 587
Trying <public ip>...
Connected to
Escape character is '^]'.
220 ESMTP Postfix
250-SIZE 10485760
221 2.0.0 Bye
Connection closed by foreign host.

Here is a portion from the mail log when receiving a message from gmail:

postfix/postscreen[93152]: CONNECT from []:48953 to []:25
postfix/postscreen[93152]: PASS NEW []:48953
postfix/smtpd[93160]: connect from[]
postfix/smtpd[93160]: 7A8C31C1AA99:[]

The log shows that a connection was made to the local IP on port 25 (I'm not doing any port mapping, so it is port 25 on the public IP too). Seeing this leads me to hypothesize that the ISP block on port 25 only occurs when a connection is made from an IP address that is not known to be a mail server. Any other theories?

share|improve this question
SMTP servers will not fall back to 587. Are you 100% certain that the messages are being delivered, via SMTP, to your server, and that port 25 is definitely blocked? You probably don't want to give your domain name out but ideally the MX records need to be double checked and tested from outside your network. – USD Matt Nov 4 '13 at 17:14
Read your mail server's SMTP logs and figure out where the traffic is coming from. – mfinni Nov 4 '13 at 17:29
Good clarifications. I've added log snippet and details of the port blocking to the question. My best guess at this point is port 25 is only blocked from IPs that are not known to be mail servers. – Josh Nov 4 '13 at 18:03
If you're not supposed to be receiving connections from the internet on a certain port then you should be blocking external traffic at your firewall, not relying on the ISP's filtering. – Sammitch Nov 4 '13 at 18:19
Since you aren't controlling the port blocking directly, why not just block it locally on the host and see if you're still receiving mail? If you're not, then port 25 is not really being filtered completely by your ISP. – phoebus Nov 4 '13 at 18:22
up vote 1 down vote accepted

There are a several simple rules that can be used to block most spam servers. Some will block legitimate but poorly configured servers.

  • Block hosts that fail rDNS (reverse DNS) validation.
  • Block hosts listed at or other blacklist. Spamhaus includes a list of addresses identified as dynamically allocated, and therefore not legitimate mail servers.
  • Only allow access from hosts which are whitelisted. has provides one such whitelist.
  • Only allow acces from hosts internal to the network (not recommmended, but common.) Note: GMail, Yahoo, and some other large providers may be connected directly to your ISP.

I commend your ISP for filtering illegitimate servers, if that is what they are doing.

share|improve this answer

Thanks to @phoebus, @mfinni, and @'USD Matt' whose comments helped make the situation clear.

I've come to the conclusion that mail is infact delivered on port 25 because if I block port 25 myself, incoming mail is no longer delivered. Confirming that mail is not being delivered via failover to port 587 as I initially suspected.

Port 25 appears to only be blocked by my ISP (Shaw in Canada) for IP addresses that do not run a mail server, e.g. from a shell on dreamhost or other non mail serving IP address the port is blocked, but known mail servers have no blocked port issues.

In case the ISP changes its port blocking strategy I have added SMTP monitoring through Interestingly, another smtp monitoring service fails to monitor because it's monitoring agent is blocked by my ISP.

share|improve this answer
ISPs typically block port 25 outbound, not inbound. – Skyhawk Nov 5 '13 at 3:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.