{
  "port": 25,
  "protocol": "tcp",
  "service": "SMTP",
  "oneLiner": "SMTP between mail servers — how mail is delivered host to host, not how your mail client submits it.",
  "whatItIs": "A sending MTA looks up the recipient domain's MX record and connects to port 25 there, then runs EHLO / MAIL FROM / RCPT TO / DATA. Modern sessions upgrade to TLS opportunistically with STARTTLS (RFC 3207). Clients should not use 25 for sending their own mail: authenticated submission is port 587 (or 465). Most residential ISPs and cloud providers block outbound 25 by default to limit spam, so a failed connection is often the network, not the server.",
  "exposure": {
    "verdict": "careful",
    "note": "An internet-facing MX on 25 is normal and required, but it must never relay for unauthenticated senders outside its own domains."
  },
  "checkCommand": "printf 'EHLO test.example\\r\\nQUIT\\r\\n' | nc -v aspmx.l.google.com 25",
  "links": [
    {
      "title": "RFC 5321 — Simple Mail Transfer Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc5321.html",
      "kind": "spec"
    },
    {
      "title": "RFC 3207 — SMTP Service Extension for Secure SMTP over TLS",
      "url": "https://www.rfc-editor.org/rfc/rfc3207.html",
      "kind": "spec"
    },
    {
      "title": "Postfix documentation",
      "url": "https://www.postfix.org/documentation.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}