Port 25 access on a VPS: why most providers block it and when it is opened

You order a VPS, SSH in, configure Postfix, and try to send a test email. The connection hangs. You check the firewall, it's wide open. But the mail never leaves the server. Port 25 is silently blocked upstream.

This is not a bug. It is a deliberate policy that nearly every major VPS provider enforces, and for good reason. The question is: when does it make sense to have port 25 open, and how do you get it unblocked without sounding like a spammer?

Why port 25 is blocked by default

默认阻止端口 25 是为了防止 VPS 被用来发送垃圾邮件，保护 IP 声誉。

Blocking port 25 by default prevents VPS instances from being used to send spam, protecting IP reputation for everyone.

Port 25 is the standard outbound SMTP port. It is also the most abused port on the internet. Spammers, phishing operations, and botnets rely on unrestricted outbound port 25 to pump mail directly from compromised servers. Once an IP gets blacklisted, Spamhaus, Barracuda, Proofpoint, it is not just that IP that suffers. On a shared infrastructure, the entire IP range can be penalised, affecting every customer on that subnet.

VPS providers sit in a difficult position. A single customer running an open relay or a compromised WordPress installation can poison the reputation of many other tenants. The simplest, most effective mitigation is to block port 25 at the provider level and make unblocking an explicit action that requires verification.

This is standard practice at DigitalOcean, Linode (Akamai), Vultr, Hetzner, and AWS Lightsail. In Vietnam, providers including Viettel IDC (the data centre arm of Viettel Group, one of three state-owned telecom operators), VNPT IDC (the data centre division of Vietnam Posts and Telecommunications Group), FPT Telecom (a major private ISP with its own data centre network), and CMC Telecom (a leading enterprise infrastructure provider) follow the same policy. thueVPS also applies this rule: every VPS is provisioned with port 25 blocked, and it stays blocked until the customer submits a request that is reviewed.

How the VPS port 25 open request process works

Getting port 25 unblocked is not automatic, but it is straightforward if you have a legitimate need. The process typically requires you to:

1. Submit a ticket or use a web form stating exactly what you will use outbound SMTP for.
2. Provide supporting information, the domain you will send from, the approximate volume, the nature of the email (transactional, marketing, system notifications).
3. Wait for manual review. Most providers, including thueVPS, check the request within a few hours during business hours. The reviewer looks for red flags: newly registered domains, no web presence, vague descriptions.

A typical approved request sounds like this: "I run a SaaS application that sends password reset emails and invoice notifications to users. The sending domain is example.com, volume is under 500 emails per day, and I have configured SPF and DKIM on the domain."

A typical rejected request sounds like this: "I need port 25 to send emails for my business. Just open it." No domain, no volume, no authentication, this is exactly how spammers ask.

Once approved, the provider whitelists your VPS IP at the network edge. You do not need to change any firewall rules on the server itself, the unblock happens upstream. The change is usually permanent on that IP, but if the IP later lands on a blacklist, the provider may block port 25 again automatically.

Legitimate use cases for opening port 25

Not everyone who asks for port 25 is a spammer. Several valid scenarios justify the request:

• Running a transactional mail server, your own Postfix or Exim installation sending order confirmations, password resets, or system alerts. This is the most common legitimate case.
• Operating an SMTP relay for internal applications, a Rails or Django app that sends mail directly rather than through a third-party relay like SendGrid or Mailgun.
• Hosting a mailing list or newsletter platform, self-hosted Mailman, Sympa, or Mautic installations that need to send from your own infrastructure.
• Testing email infrastructure in a staging environment, a development VPS that mirrors production and needs to send test messages to verify deliverability.

In each of these cases, the provider expects you to take responsibility for email authentication and sender reputation. An open port 25 without SPF, DKIM, and DMARC configuration is almost useless, the mail will be rejected or flagged as spam by most receiving servers.

What it takes to maintain email deliverability after port 25 is open

Having port 25 unblocked is a prerequisite, not a guarantee. Once the port is open, you must set up three things before sending any mail:

1. rDNS (PTR record), the reverse DNS of your VPS IP must resolve to a hostname that matches the HELO hostname your MTA uses. Without this, many mail servers will reject your connection before it even reaches the content filters. Most providers, including thueVPS, offer free rDNS configuration for each dedicated IPv4.
2. SPF record, a TXT record in your domain's DNS that lists which IPs are allowed to send mail on behalf of that domain. Example: v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all.
3. DKIM signature, a cryptographic signature added to each outgoing message. The public key is published as a TXT record, and receiving servers verify the signature against it. This proves the message was not tampered with in transit.
4. DMARC policy, a TXT record that tells receiving servers what to do with messages that fail SPF or DKIM: quarantine, reject, or none (monitoring only). A DMARC report also gives you visibility into unauthorised use of your domain for email.

Skipping any of these means your mail will land in spam, regardless of port 25 being open. The port is the door; authentication is the ID check that lets you through the door.

When not to ask for port 25 open

Not every email need requires port 25. For many use cases, a third-party SMTP relay is a better choice:

• Marketing campaigns, services like Mailchimp, SendGrid, or Amazon SES handle large volumes with warm IPs and established reputation. Sending 50,000 newsletters from a single Vietnam VPS IP will hurt deliverability, especially if that IP is new and untrusted.
• Transactional email at scale, high-volume password resets, order notifications, and system alerts benefit from dedicated infrastructure like Amazon SES or Mailgun, which maintain their own IP reputation pools.
• Email for small sites with no technical email expertise, if you do not know what SPF or DKIM is, a third-party relay is safer than self-hosting. You will get higher deliverability with less effort.

A VPS with SMTP focus makes sense when you want full control, need a clean dedicated IP for sending, or run a product that integrates directly with the MTA on the server. For everything else, a relay is the pragmatic choice.

What happens after you move from an approved request to active sending

Once port 25 is open and your authentication records are in place, the real work begins: building reputation. A brand new Vietnam IP on a fresh VPS has no sending history. The first 500 messages will land in more spam folders than inboxes, regardless of correct setup.

The standard approach is warm-up: start with a low volume, 50-100 messages per day per IP, and increase gradually over two to four weeks. Monitor bounce rates, spam complaints, and DMARC aggregate reports. A complaint rate above 0.1% or a bounce rate above 5% means you are sending too fast or the list is not clean.

Even with proper warm-up, some providers may still block port 25 if they detect anomalous behaviour later. Automated systems look for sudden spikes in volume, high failure rates, or connections to known spam traps. A provider that unblocks port 25 has no obligation to keep it unblocked if your IP ends up on a blacklist. Most will give you a warning first, "Your IP is listed on Spamhaus. Open a ticket if you want to investigate before we take action.", but the block can come back.

The transparent policy as a trust signal

There is a reason providers make port 25 a deliberate opt-in rather than a firewall rule you can change yourself. The policy does two things at once: it reduces the noise of spam infrastructure being provisioned on the platform, and it signals to legitimate customers that the provider cares about IP hygiene.

When a provider blocks port 25 by default and requires a review to unblock it, they are filtering out the worst actors before those actors can cause damage. This protects the IP pool for everyone else on the network. A Vietnam VPS with a clean, dedicated IPv4 is valuable precisely because the provider took steps to keep it clean. Without that default block, every IP in the range would be drenched in abuse reports by week two.

The transparent review process also acts as a deterrent. Spammers rarely want to explain their use case in a support ticket. Legitimate businesses have no problem providing a domain and a volume estimate. The friction is minimal for honest users and insurmountable for bad actors.

FAQ

Related articles

• Why shared SMTP relays hurt deliverability once you scale
• Warming up a new sending IP: a realistic 30-day schedule
• SPF, DKIM and DMARC on a self-hosted SMTP server
• Cheap Linux VPS Vietnam with multiple IPv4 for PowerMTA