Organizations blocking port 25 (SMTP) traffic

SMTP (Simple Mail Transport Protocol) uses IP Port 25 to send email.

Most email clients connect to an outgoing server via port 25 whenever they send a message. If the message is to a user on another server, the sending server then connects to the destination server via port 25 and passes on the email.

End-user systems should always connect to an outgoing SMTP server managed by their organization, or their organization's ISP. There is no reason for a desktop to need to connect directly to third-party's SMTP server.

When a system is compromised by spammers, the software that's installed tries to connect directly to the recipient's SMTP server when sending junk mail. These "spam zombies" may attempt connections to hundreds or thousands of different SMTP servers each hour.

The risk to companies isn't just that they lose productivity due to networks flooded with stray SMTP traffic. As soon as a piece of spam gets reported which can be traced back to their outgoing IP address - they will find themselves listed on one or more DNS blacklists or DNSBLs.

They will then find a large percentage of their email being bounced. Almost all email server administrators are now using one or more DNSBLs to stop spam mail. While this does cause some messages to be errantly rejected, there is no question that blacklists are a highly effective way to reduce the amount of junk received.

Getting off some of these lists can be easy - while other DNSBL's have exceedingly strict removal policies.

This presents a strong incentive for organizations not to send spam.

In response, many organizations are blocking port 25.

Usually port 25 access is maintained to the organization's own outgoing server. Some configurations (such as those using Exchange server) provide other mechanisms for sending email from desktops - in which case port 25 can be shutdown completely.

Back