Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →If a Linux VPS cannot deliver mail, check outbound SMTP access before changing Postfix. Providers commonly block outbound TCP port 25 (and, on some platforms, ports 465 and 587) at the network edge. A timeout to several recipient mail servers usually confirms an upstream restriction, while a refusal, DNS error, TLS failure or authentication error points elsewhere. For websites sending password resets, alerts or receipts, an authenticated SMTP relay on port 587 is normally the quickest and safest fix. A self-hosted server should request port-25 access only after its hostname, reverse DNS and email authentication are ready.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Start with the failure you can actually observe
“Email does not work” can describe several unrelated faults. Read the mail log and queue first, then classify the error. On a Postfix system, useful commands are:
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemssudo postqueue -p
sudo journalctl -u postfix -n 100 --no-pager
sudo tail -n 100 /var/log/mail.logOn distributions that use a different log location, inspect the MTA’s own log directory. Look for the destination domain, the remote host, the SMTP status code and whether the connection ever completed.
| What you see | Most likely meaning | First check |
|---|---|---|
| Connection timed out | Outbound port 25 is filtered by the VPS provider, a cloud firewall or an upstream network. | Test several recipient MX hosts and inspect provider egress rules. |
| Connection refused | The destination actively rejected the connection, or a local firewall or routing rule is interfering. | Test another MX and review local firewall rules. |
| Network is unreachable | Missing route, disabled address family or a broken IPv6 path. | Check routes and test IPv4 and IPv6 separately. |
| Temporary DNS failure | The VPS cannot resolve the recipient domain or its MX records. | Query DNS directly and verify the resolver configuration. |
| TLS or certificate error | The connection reached a server, but encryption negotiation failed. | Check the relay hostname, system clock, CA certificates and TLS settings. |
| Authentication failed | The relay rejected the username, password or authentication mechanism. | Verify credentials, account status and the relay’s required port and security mode. |
| Recipient bounce after delivery attempt | The receiving system rejected the message because of policy, identity, content or reputation. | Read the complete SMTP response and inspect authentication results. |
A “sent” status in an application usually means the application handed the message to the local MTA. It does not prove that the remote server accepted or delivered it.
Test DNS and the network path to recipient mail servers
Find the recipient’s MX hosts
Query the domain in the address, not your own mail hostname:
dig +short MX recipient-domain.exampleSort the returned hosts by their preference value and test more than one. Large domains often publish several MX records, and one host can be temporarily unavailable without proving that your VPS is blocked.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test TCP port 25 directly
Use the actual MX hostname from the DNS response:
nc -vz mx1.recipient-domain.example 25A successful result normally reports that the TCP connection succeeded; an SMTP banner may appear if you use a verbose client. Repeat the test against another MX host and, if possible, another recipient domain. PineRiver’s diagnostic guidance treats repeated timeouts to several receivers as evidence that port 25 is not open or is being filtered upstream.
Do not substitute port 587 in this test. Port 25 is the normal server-to-server delivery channel. Remote MX servers generally do not accept arbitrary alternate ports for incoming delivery, so proving that 587 is reachable does not prove that direct delivery will work.
Check the local route and address family
ip route get 203.0.113.10
ip -6 route
getent ahosts mx1.recipient-domain.exampleIf the MX has both A and AAAA records, an unusable IPv6 route can cause delays or failures before the MTA falls back to IPv4. Temporarily forcing an IPv4 test with the address returned by DNS helps separate an IPv6 problem from a port-25 policy.
Check both firewalls, not just UFW
Inspect the VPS operating system
For UFW:
sudo ufw status verboseFor nftables:
sudo nft list rulesetFor older iptables-based systems:
sudo iptables -S
sudo iptables -L -n -vThese commands show local filtering, but an empty local ruleset does not override a provider’s network policy. Outbound SMTP may be blocked before packets leave the provider’s network.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchInspect the provider’s cloud firewall and egress policy
Open the VPS control panel and look for outbound or egress rules, security groups and network ACLs. Permit TCP 25 only if you have a clear operational reason and the provider allows it. If the provider documents a central block, changing the cloud firewall will not remove it. IONOS, for example, states that its port-25 restriction is controlled centrally rather than in the Cloud Panel firewall.
Record the exact test time, destination MX hosts and results before contacting support. This gives the provider enough information to distinguish a policy block from a transient route failure.
Decide whether you need direct delivery or an SMTP relay
The correct architecture depends on what the VPS is sending and how much mail administration you are prepared to own.
| Consideration | Direct delivery from the VPS | Authenticated SMTP relay |
|---|---|---|
| Network requirement | Outbound TCP 25 must be permitted. | Usually uses submission port 587 with STARTTLS; no port-25 unblock is required. |
| Identity and DNS | You maintain the sending hostname, A/AAAA, PTR, SPF, DKIM and DMARC. | You publish the relay’s SPF and DKIM instructions and keep your visible domain aligned. |
| Operations | You handle MTA updates, queues, abuse reports, blocklists, rate control and reputation. | The relay operates the delivery infrastructure; you still manage credentials, domain authentication and application behavior. |
| Best fit | A mail operator that needs server-to-server control and can maintain reputation. | Web forms, password resets, invoices, alerts and other transactional notifications. |
DigitalOcean explicitly recommends a third-party email service when SMTP is blocked and warns that self-hosted delivery requires continuing security and reputation work. That advice applies broadly to notification-only applications: a relay removes the hardest network and reputation tasks without requiring you to run a public mail system.
Recommended Free Tools
Fix the common case: configure an authenticated relay on port 587
Use the relay provider’s hostname, account and DNS values; the names below show the required settings rather than a particular commercial service.
1. Create and verify the relay account
Create a sending identity in the relay service, add the domain used in the From address and complete any ownership verification. Generate a dedicated SMTP credential instead of reusing a personal mailbox password.
2. Publish the relay’s DNS records
The relay will normally give you a DKIM TXT record and an SPF include value. Add the DKIM record exactly as supplied. Merge the relay’s SPF mechanism into your existing SPF record; publish one SPF record for the domain rather than creating competing records. If you already use another sender, preserve its authorized mechanism while adding the relay.
3. Configure Postfix
Edit /etc/postfix/main.cf and set the relay host and submission security. A typical configuration is:
relayhost = [smtp.relay-provider.example]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crtThe CA-file path differs by distribution. Use the path provided by your operating system, and confirm that its certificate bundle is current.
4. Store credentials safely
Create /etc/postfix/sasl_passwd with the relay host, port, username and password in the format documented by the relay. Restrict the file, build the lookup database and restart Postfix:
sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap hash:/etc/postfix/sasl_passwd
sudo systemctl restart postfix
sudo systemctl --no-pager --full status postfixDo not put credentials in application source code or world-readable configuration. If the relay supports scoped keys, limit one key to the required sending domain and rotate it when staff or systems change.
5. Test TLS and send a controlled message
openssl s_client -starttls smtp -connect smtp.relay-provider.example:587 -crlfYou should see a certificate for the relay hostname and a successful STARTTLS negotiation. Then send a message to an address you control and watch the log:
sudo journalctl -u postfix -fAfter the relay accepts the message, inspect the delivered copy’s original headers. A relay acceptance is only the first handoff; the receiving mailbox still evaluates authentication, reputation and content.
If you want direct delivery, prepare the server before requesting an unblock
Do not ask a provider to open port 25 for an unidentified or freshly configured host. Prepare a consistent identity first.
Use a stable mail hostname
Choose a fully qualified hostname such as mail.example.net. Publish an A record pointing that hostname to the VPS’s public IPv4 address. If you intend to use IPv6, publish an AAAA record only when the address is stable and has working reverse DNS and routing.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set reverse DNS (PTR)
Ask the VPS provider to set the sending IP’s PTR record to the mail hostname. Google’s Gmail sender guidance states: “The public IP address of a sending SMTP server must have a corresponding PTR record that resolves to a hostname.” That hostname must also resolve forward to the same sending IP. A mismatch is a common reason for rejection or poor trust.
Publish SPF, DKIM and DMARC
- SPF lists the systems authorized to send for your domain.
- DKIM adds a cryptographic signature that receivers can verify with a DNS public key.
- DMARC tells receivers how to handle messages that fail SPF or DKIM alignment and provides reporting options.
Google recommends using all three. Cloudflare notes that missing SPF or DMARC can lead to rejection or inconsistent delivery. Keep the visible From domain aligned with the domain authenticated by DKIM or SPF; otherwise a message can pass one check but fail DMARC alignment.
Request the provider exception
Submit the request only after the DNS records have propagated and you can show the hostname, PTR, SPF and intended sending volume. Policies vary by provider, account age and abuse history. Some providers require an explanation of the application, rate limits and abuse-contact process.
Know the provider policies that commonly cause confusion
Port restrictions are provider-specific and can change, so read the policy for your exact product and region.
| Provider documentation | Policy or requirement | Practical implication |
|---|---|---|
| DigitalOcean, page verified July 13, 2026 | Ports 25, 465 and 587 are blocked by default on Droplets to prevent spam and abuse. | A relay may require an unblock request or a different supported path; confirm current account policy. |
| OVHcloud, May 28, 2026 | Port 25 is blocked by default on Public Cloud instances; infrastructure exceptions are documented. | Use the documented exception process or submit through port 587 with STARTTLS. |
| IONOS | Port-25 restrictions are controlled centrally, not by the Cloud Panel firewall; a valid FQDN, PTR and SPF are listed as prerequisites for unblocking. | Changing local or panel firewall rules cannot substitute for the provider request. |
| cPanel guidance, January 29, 2026 | Many providers block outbound port 25 to prevent spam from their networks. | Expect a network-level policy rather than a Postfix setting to be the cause. |
These are examples of documented policies, not a universal rule. A timeout from one VPS provider does not prove that every provider blocks the same ports.
Read the queue instead of repeatedly retrying blindly
Inspect queue entries and destinations
sudo postqueue -p
sudo postcat -q QUEUE_IDReplace QUEUE_ID with the identifier shown by the queue listing. Look for repeated “deferred” entries, the next retry time and the last SMTP response. A growing queue with connection timeouts indicates a network path problem; a queue that clears but produces bounces indicates a remote policy or identity problem.
Force a retry after fixing the cause
sudo postqueue -fFlush the queue only after correcting the underlying issue. Repeatedly flushing a blocked queue creates needless connection attempts and can worsen rate-limit or abuse signals.
Check that the service is listening locally
sudo ss -ltnp | grep ':25'This checks the local SMTP listener used by applications and other hosts. It does not test outbound connectivity to a recipient MX. A listener can be healthy while every outbound connection is filtered upstream.
Interpret common fixes that do not solve the real problem
- Opening inbound port 25: This allows other systems to connect to your MTA; it does not allow your VPS to make outbound connections.
- Changing Postfix’s destination port to 587: Recipient MX servers normally expect server-to-server traffic on 25. Use 587 for an authenticated submission relay, not arbitrary direct delivery.
- Restarting Postfix repeatedly: A restart cannot remove a provider’s network block. It is useful after a configuration change, not as a connectivity test.
- Adding multiple SPF records: Receivers can treat multiple SPF records as a permanent error. Combine authorized senders into one record.
- Using an IP address in the relay hostname: TLS certificates are issued for hostnames. Use the relay’s documented hostname so certificate validation and policy checks work.
- Assuming SMTP acceptance means inbox placement: The receiving server can accept a message and later classify it as spam, or deliver it to a quarantine folder.
Improve delivery after mail starts leaving the VPS
Inspect the original headers
Open the message’s “show original” or equivalent view and find the Authentication-Results header. Check for spf=pass, dkim=pass and dmarc=pass. A successful TCP connection or a local “sent” log entry does not establish any of these results.
Keep identity consistent
The envelope sender, visible From address, DKIM signing domain, SPF authorization and PTR hostname should describe the same sending organization. Sudden changes in IP, hostname or volume can hurt reputation even when authentication passes.
Control volume and abuse
Set application rate limits, reject unauthorized relay attempts, require authentication for submission and monitor queue growth. Separate transactional mail from bulk campaigns when the relay supports separate streams or credentials. Remove invalid recipients quickly so repeated bounces do not damage reputation.
Meet Gmail’s high-volume requirements
Google’s sender requirements, effective in 2024, apply to senders delivering more than 5,000 messages per day to personal Gmail accounts. At that volume, authentication, low spam rates and one-click unsubscribe requirements for promotional mail become operational requirements rather than optional improvements. Transactional messages still need correct authentication and reputation controls.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical decision path
- Read the MTA log and queue, and classify the error as timeout, refusal, DNS, TLS, authentication or recipient rejection.
- Query the recipient domain’s MX records and test TCP 25 to at least two MX hosts.
- Check local firewall rules, routes and IPv6 behavior, then inspect provider egress controls.
- If port 25 is blocked and the VPS sends application notifications, configure an authenticated relay on port 587 with STARTTLS.
- If you genuinely operate a self-hosted mail server, configure the mail hostname, forward DNS, PTR, SPF, DKIM and DMARC before requesting an unblock.
- Send a controlled test, inspect the receiving headers and verify all three authentication results.
- Monitor the queue, bounces, delivery latency and reputation continuously rather than treating the first successful message as completion.
Security checklist for a VPS mail sender
- Keep the operating system, MTA and TLS libraries patched.
- Disable unauthenticated relay behavior and test that an outside host cannot relay through the server.
- Restrict SMTP credentials to the applications that need them and rotate them on staff or infrastructure changes.
- Use a firewall to limit management services and expose only the mail ports required by your chosen architecture.
- Monitor authentication failures, queue size, outbound volume and provider abuse notices.
- Back up DNS configuration, DKIM keys and MTA settings securely; treat private DKIM keys as secrets.
Frequently Asked Questions
Can I send mail directly if port 25 is blocked but port 587 is open?
Not reliably to arbitrary recipient MX servers. Port 587 is a message-submission port for an authenticated relay; configure a relay there instead of changing direct-delivery destinations to 587.
How long does a provider port-25 unblock take?
The supplied provider policies do not establish a universal time. Approval depends on the provider, account history, region and the identity and abuse controls you submit, so ask the provider for its current process.
Should I disable IPv6 if mail is failing?
Only as a diagnostic or when your IPv6 route and reverse DNS are not ready. Test IPv4 and IPv6 separately first; disabling an address family does not fix a provider-wide port-25 block.
Why does a test message arrive in spam even though SPF, DKIM and DMARC pass?
Authentication proves domain authorization and message integrity, not reputation or content quality. Receiving systems also consider sending history, complaint rates, recipient engagement, volume changes and message content.
Is a local SMTP listener required when my application uses a relay directly?
No. An application can submit directly to the relay with SMTP authentication. A local MTA is useful when multiple services need centralized queueing, logging and retry management.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
