SMTP between mail servers — how mail is delivered host to host, not how your mail client submits it.
A sending MTA looks up the recipient domain's MX record and connects to port 25 there, then runs EHLO / MAIL FROM / RCPT TO / DATA. Modern sessions upgrade to TLS opportunistically with STARTTLS (RFC 3207). Clients should not use 25 for sending their own mail: authenticated submission is port 587 (or 465). Most residential ISPs and cloud providers block outbound 25 by default to limit spam, so a failed connection is often the network, not the server.
Expose with care
An internet-facing MX on 25 is normal and required, but it must never relay for unauthenticated senders outside its own domains.
$ printf 'EHLO test.example\r\nQUIT\r\n' | nc -v aspmx.l.google.com 25Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.