Port 25 blocked? How your server, NAS or web shop can still send email

When outbound port 25 is blocked by your internet provider or cloud host, your server, NAS, printer or web shop cannot deliver email directly. The fix is an authenticated SMTP relay on port 587 (STARTTLS): your device hands the mail to the relay with a login and password, and the relay delivers it onward. You are not bypassing anything; you are simply using the port that was designed for this.

Below you will read why the block exists, how to recognise it and how to get sending again in four steps. 2Mail provides such a relay from Belgium; what the service includes is at the bottom of the page.

Why providers and hosts block port 25

Port 25 is the port on which mail servers exchange email with each other, without a login. That is exactly why spammers love it: an infected PC or a hijacked server can push thousands of messages out into the world through it directly.

Abuse by malware and botnets

Most internet providers block outbound connections on port 25 from consumer and small-business lines, so an infected device on their network cannot send spam. That protects the reputation of their IP ranges, and with it the reputation of their honest customers.

Belgian internet providers

At Belgian providers such as Proximus, Telenet, VOO and Orange, the block is active on most connections. Whether it can be lifted depends on the provider and the subscription, and that changes regularly. Ask, but do not count on it.

Cloud hosts and VPS providers

Anyone renting a virtual server runs into it too: many cloud platforms close port 25 by default for new accounts and point to a relay on port 587. That is not an outage, it is policy.

So the block is not a fault in your software and not a reason to change provider. It is a good reason to do what mail clients have done for years: authenticate with a sending server on port 587.

How to tell that port 25 is the culprit

The complaints look alike, but the cause sits in the network layer, not in your software. These signs point to a blocked port 25.

! A connection test to a mail server on port 25 hangs and ends in "connection timed out", while port 587 does answer.
! Your mail server log is full of "deferred" or "connection refused" to every external domain, not to one particular recipient.
! Your NAS or backup software reports that the notification email cannot be sent, although the settings are correct.
! The scan-to-email function of your multifunction printer worked at the old location and no longer works on the new internet connection.
! Your web shop or CRM shows no error, but the confirmation emails arrive nowhere and the queue silently fills up.

The fix: an authenticated relay on port 587

Instead of knocking on the receiving server's door on port 25 itself, your device hands the email to a relay it authenticates with. That relay sits on a network where port 25 is open, has a maintained reputation and delivers the mail onward.

Port 587 with STARTTLS

The recommended choice. The connection starts normally and switches to TLS straight away, after which you sign in with a login and password. Practically every device and application supports it.

A separate login per device

Give your NAS, your printer and your web shop each their own SMTP login. If one device gets infected or is taken out of service, you revoke that single login without stopping the rest.

Your own sender domain

The relay sends on behalf of your domain. So set up SPF, DKIM and DMARC, so the receiving server knows the relay is allowed to do that. Otherwise the mail still lands in spam, open port or not.

How does an SMTP relay work? Set up SPF, DKIM and DMARC

Step by step: from blocked to delivered

Whether it is a Linux server, a NAS, a multifunction printer or a web application, the steps are the same. Only the location of the settings screen differs.

1

Confirm that port 25 is closed and port 587 is open

From the device or the network, test a connection to a mail server on port 25 and then on port 587. If 25 hangs and 587 answers, you have found the cause. Use your system's network tools; on a NAS or printer, the built-in test function is enough.

2

Create an SMTP login at the relay

Register your sending domain with the relay and create a separate login per device or application. Note the server name, port 587, STARTTLS, username and password. At 2Mail you do this in the dashboard.

3

Enter the settings on the server, NAS, printer or web app

On a mail server, configure the relay as the "smarthost" or "relayhost". On a NAS or multifunction printer, choose SMTP with authentication in the notification or scan-to-email menu. In WordPress, Odoo or a Laravel app, enter the same details in the mail settings.

4

Set up SPF and DKIM and send a test email

Place the DNS records the dashboard gives you and send a test to a Gmail and an Outlook address. Check in the relay's logs that the mail is marked as delivered. From then on the relay watches delivery for you.

How 2Mail does it

2Mail is the managed SMTP relay of JAAN bv, with its own servers in Belgium. This is what you get in practice.

SMTP with STARTTLS on port 587, with a separate login per device or application that you can revoke individually.
Works with any SMTP client: mail servers, NAS devices, multifunction printers, WordPress, WooCommerce, Odoo, PrestaShop, Magento, Microsoft 365 and Laravel.
SPF, DKIM and DMARC in one click from the dashboard, logging of deliveries, bounces and rejections per domain.
Maintained IP pool with automatic retry on greylisting and throttling, 99.99% platform availability and 24/7 monitoring.
Processing and storage inside the EU, data processing agreement on request, price per volume tier and per domain with no setup fee.
Support in Dutch, French and English on +32 9 328 03 83, including the settings for your specific device.
See the pricing SMTP relay in Belgium Get in touch

Frequently asked questions about blocked port 25

Port 25 is the port on which mail servers exchange email with each other without a login, which makes it the favourite exit for spam from infected devices. Most internet providers and many cloud hosts therefore close outbound port 25 by default. It is policy, not an outage.
From the device, test a connection to a mail server on port 25 and then on port 587. If 25 hangs on "connection timed out" while 587 answers, the port is blocked. A log full of "deferred" to every external domain points the same way.
With some providers and on some subscriptions you can, with many you cannot, and the policy changes regularly. Ask, but do not build on it: an authenticated relay on port 587 works everywhere and simply moves with you when you change connection.
Port 587 with STARTTLS, the standard for authenticated sending. You sign in with a login and password from the relay.
Yes. Practically every NAS and multifunction printer has an SMTP setting with authentication in the notification or scan-to-email menu. Enter the relay's server name, port 587, STARTTLS and a separate login per device there.
Yes: the relay sends on behalf of your domain, so SPF, DKIM and DMARC have to allow that. At 2Mail you set those records up in one click from the dashboard. Without that step the mail does leave, but lands in spam more often.
Call us
Send an email