Common attacks and weaknesses
- Open relays used to send spam and phishing.
- User enumeration with VRFY and EXPN.
- Spoofed senders when SPF, DKIM and DMARC are missing.
Port 25: SMTP
Server-to-server email delivery. Supports STARTTLS, which is opportunistic unless MTA-STS or DANE is used.
25
How SMTP works
EmailMail servers hand messages to each other over port 25, one hop at a time, until the recipient's server. Encryption is optional: it only happens if both sides negotiate TLS (STARTTLS).
- Transport
- TCP · UDP
- Exposure risk
- 4/10 moderate if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
Is port 25 dangerous?
How to secure it
- Refuse relaying for unauthenticated clients.
- Disable VRFY and EXPN.
- Publish SPF, DKIM, DMARC and MTA-STS (check them with the Email Security Checker).
IANA registry entries for port 25
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| smtp | 25 | TCP, UDP | Simple Mail Transfer | RFC-ietf-emailcore-rfc5321bis-43 | 2017-06-05 |
// source: IANA service name and port number registry
Which program uses port 25, and is it reachable?
Linux
sudo ss -ltnup 'sport = :25' # process listening on 25
sudo lsof -nP -i :25macOS
sudo lsof -nP -i :25
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 25 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 25 netstat -ano | findstr :25
From another machine
nmap -p 25 -sV <host> sudo nmap -sU -p 25 <host> nc -zv <host> 25
Block it in the firewall
sudo ufw deny 25/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 25" -Direction Inbound -LocalPort 25 -Protocol TCP -Action Block # Windows
What is port 25 used for?
Server-to-server email delivery. Supports STARTTLS, which is opportunistic unless MTA-STS or DANE is used.
Is port 25 TCP or UDP?
Port 25 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 25?
It is rated 4/10 (moderate) when exposed to the Internet. Open relays used to send spam and phishing. Refuse relaying for unauthenticated clients.
How do I check if port 25 is open?
On Linux run "ss -ltnup 'sport = :25'", on macOS "lsof -nP -i :25", and on Windows "netstat -ano | findstr :25" to see the local process. From another machine, "nmap -p 25 <host>" shows whether it is reachable.