IMAP, SMTP and POP3 ports, and why port 25 is blocked on your VPS

Disclosure: I run Bigdomainhost, an Indian hosting company. This is adapted from two pieces on our site.

A lot of "my email is broken" problems aren't broken email. They're one wrong number in a mail client, or an application trying to send on port 25 from a VPS where port 25 is blocked on purpose.

So here is the short version of mail ports, then the longer explanation of port 25, because that one deserves it.

The table

Seven ports in that table, and only four of them belong in a mail client: 993, 995, 587, 465.

Incoming: use IMAP on 993

IMAP keeps mail on the server and syncs it. Read something on your phone and it's read on your laptop. Make a folder in one place and it exists everywhere. Once you have more than one device, it's the only sensible choice.

POP3 downloads mail to one machine and by default deletes the server copy. That made sense when storage was expensive and connections were metered. Today its main effect is that your mail archive dies with the laptop it was on.

Port 143 and 110 are the unencrypted originals. Anything over them, including your password, crosses the network in plain text. Don't.

Outgoing: 587 or 465, doesn't matter much

Both are submission ports, meaning your mail client hands a message to your provider's server with a username and password. The only difference is how encryption starts:

• 587 with STARTTLS: connect in plain text, then immediately upgrade to TLS. This is the current standard.
• 465 with implicit TLS: encrypted from the first byte. It was deprecated in 1998, brought back in 2018, and is supported basically everywhere.

Pick 587 unless something tells you otherwise. If one is blocked on the network you're on, try the other.

Settings that work

# Incoming
Server:    mail.yourdomain.com
Port:      993
Security:  SSL/TLS
Username:  [email protected]     # the FULL address

# Outgoing
Server:    mail.yourdomain.com
Port:      587
Security:  STARTTLS
Auth:      Yes, same username and password

Two mistakes account for most failed setups we see:

1. Using you as the username instead of [email protected].
2. Leaving "outgoing server requires authentication" unticked.

Neither produces an error that says what's actually wrong. You just get "connection failed" or "relay denied" and start doubting everything else.

Port 25: what it's actually for

Port 25 is SMTP relay. It's how mail servers hand messages to each other. When Gmail delivers to your mail server, it connects to your port 25.

It is not the port your mail client or your application should send on. That's submission, on 587, with authentication. That split was formalised in 1998. It's still widely misunderstood.

Why outbound 25 is blocked

Port 25 comes from 1982, when every host on the network was run by someone you could phone. It requires no authentication by design.

Today that means any machine that can open outbound connections on port 25 can send mail claiming to be from anyone. An out-of-date WordPress, a leaked SSH key, a weak database password, and the server becomes a spam relay in minutes.

The damage doesn't stay on that one machine. Blacklists like Spamhaus work on IP ranges. One compromised server in a /24 can get the whole block listed, and then nobody in that range can deliver to Gmail, Outlook or anyone else who checks the list.

So we block outbound 25 by default. So do AWS, Google Cloud, Azure and DigitalOcean, and so do most Indian broadband providers and mobile networks. It isn't one host being difficult; it's thirty years of internet-wide practice.

The way I'd put it to a customer: the block isn't a restriction on you. It's the reason the IP you were given can deliver mail at all. Inbound 25 stays open, so receiving mail is unaffected.

What to use instead

For WordPress this is a five-minute change. Install an SMTP plugin, point it at port 587 with a real mailbox and password, and stop relying on PHP's mail(). Mail sent through mail() from a web server has poor deliverability even where 25 is open, because it arrives unauthenticated from an IP with no mail reputation.

Testing from the command line

Before blaming the client, check the port is reachable from where you are:

# is the port open from this network?
nc -vz mail.yourdomain.com 587
nc -vz mail.yourdomain.com 993

# does TLS negotiate, and which certificate comes back?
openssl s_client -connect mail.yourdomain.com:993 -quiet
openssl s_client -starttls smtp -connect mail.yourdomain.com:587

If nc times out on your office Wi-Fi but works on a mobile hotspot, your network or ISP is blocking the port. That's the single most common cause, and no amount of client fiddling fixes it.

The openssl output also shows the certificate name. If it's issued for the server's own hostname and you're connecting to mail.yourdomain.com, your client will throw a certificate warning. Use the hostname your provider gives you.

Last thing to check: the password. Mail clients cache old passwords and can fail quietly for days after a change.

Should you run your own outbound mail server?

My honest recommendation: no, unless mail is your product.

Deliverability is a specialist job. You have to warm an IP, maintain reputation, handle bounces and complaints, stay off blacklists and react when you land on one anyway. A transactional provider does all of that for a fee that's almost certainly less than the hours you'd spend.

If you do need it, on a VPS or dedicated server with us outbound 25 can be opened. We ask four things first, and they're the same questions any competent mail operator should be asking themselves:

1. What mail server software, and is it configured to refuse open relay?
2. What volume, and to whom? Transactional, or a list?
3. Are SPF, DKIM, DMARC and reverse DNS in place? Without them the mail won't be delivered anyway.
4. Who answers an abuse report at 3am?

If the answers are ready, the block comes off.

For mail on your own domain without that work, our business email hosting runs on mail-only IPs with SPF, DKIM, DMARC and reverse DNS set up from day one. The longer write-up on port 25 is in our engineering notes, and the original port guide is here. Prices for every plan are on our pricing page.

Posted by the Bigdomainhost team. The original version of this guide is on our site.