Is it possible to run an SMTP server like postfix on a Google Cloud instance without using an external mail provider by relay?

Question

Objective: Need to install an SMTP server (preferably postfix) that will send messages to other common mail providers like gmail, outlook, yahoo, etc.

Problem: Google Cloud blocks usage of SMTP port 25 (but not 465 or 587) and only provides details on how to use external mail providers. Another workaround is to create a gmail account, configure relay as smtp.gmail.com and use the said account to send the messages. The problem with this is that the daily message limit for the relay is probably going to be exceeded with the volume of messages that are expected to be sent.

Tried:

1. Sending a message using mail on ubuntu 18.04 on google cloud using the default postfix configuration and only changing "inet_protocols" to "ipv4". This gives a timeout message on log.

postfix/smtp[]: connect to ALT2.ASPMX.L.GOOGLE.COM[x.x.x.x]:25: Connection timed out

2. Tried changing the following lines in master.cf

smtp inet - - y - - smtpd

smtp unix - - y - - smtp

to

587 inet - - y - - smtpd

587 unix - - y - - smtp

adding "smtp_use_tls = yes" to main.cf

and restarting postfix. This puts postfix listening and sending messages on port 587, but it still gives the same massage.

postfix/smtp[]: connect to ALT3.ASPMX.L.GOOGLE.COM[x.x.x.x]:587: Connection timed out

3. Messages are sent by using the same configuration as on 1 in another hosting service (port 25 not blocked).

There are people that say smtp between servers only works on port 25, but I've been unable to find any information that confirms this, and not knowing much about mail servers am unsure if it's at all possible to configure another port on postfix for this effect.

Am I just wasting my time trying to configure this on Google Cloud and should just change hosting service? Or is there some kind of way to configure postfix to work with port 25 blocked?

Answer 1

This was first decided back in 1982 with RFC 821, Appendix A and has been this way ever since. Currently the TCP port 25 is IANA assigned for this purpose, too. From SMTP RFC 5321:

4.5.4.2. Receiving Strategy

The SMTP server SHOULD attempt to keep a pending listen on the SMTP port (specified by IANA as port 25) at all times. This requires the support of multiple incoming TCP connections for SMTP.

You cannot simply change the port, because there is no mechanism for other SMTP servers to know you are using a non-standard port, and you cannot either send to other servers using any other port.

The Google Cloud is not designed for this, as explained in their guide: Sending email from an instance:

Using standard email ports

By default, Compute Engine allows outbound connections on all ports except port 25, which is blocked because of the risk of abuse. All other ports are open, including ports 587 and 465.

Note: Port 25 is always blocked and can't be used, even through an SMTP relay using Google Workspace.

The ports 587 and 465 are available for SMTP Message Submission (RFC 6409). This means you can use an external mail relay (your own or from someone else) for authenticated SMTP, and this server handles delivery to other mail systems on port 25.