Does Hetzner / Contabo / DigitalOcean Allow Port 25? The Real Answer
Three providers, three completely different answers. Contabo opens port 25 the moment you provision. Hetzner makes you wait a month. DigitalOcean blocks it permanently. The search results for "does [provider] allow port 25" are full of outdated forum posts and vague answers, so here's the current state for each one, sourced from official documentation.
Hetzner: yes, after ~1 month
Hetzner blocks outbound traffic on ports 25 and 465 on all new Cloud servers. This isn't a bug or an oversight. It's a deliberate anti-spam measure that Hetzner has maintained for years.
How to get port 25 opened
- Be a Hetzner customer for approximately 30 days.
- Pay at least one invoice (this confirms you're not a disposable account).
- Open the Hetzner Cloud Console, navigate to your project, and submit a "limit request" for SMTP.
- Explain your use case: personal mail server, business email, transactional mail. Be specific.
- Wait for approval. Hetzner reviews requests individually. Most legitimate use cases are approved within a few business days.
Port 587 (submission with STARTTLS) is not blocked. You can use it from day one with an external relay service like SendGrid or Mailgun if you need email before your limit request is approved.
Why the wait is actually an advantage
The month-long gate keeps throwaway accounts off Hetzner's IP ranges. Every spammer who would sign up, blast emails, and abandon the server gets filtered out before they can damage the IP pool. The result: Hetzner's IP reputation is meaningfully cleaner than providers that open port 25 immediately. When your limit request is approved, you're starting with an IP that receiving mail servers are less likely to distrust on sight.
PTR records are configurable in the Hetzner Cloud Console under the networking section for each server. This is essential for email and Hetzner makes it self-service.
Contabo: yes, immediately
Contabo opens port 25 by default on all VPS plans. No support ticket, no control-panel toggle, no waiting period. Your server can send outbound SMTP the moment it's provisioned.
The rate limit
Contabo enforces a limit of 25 outbound emails per minute (1,500 per hour). This is how Contabo handles spam prevention without blocking the port entirely: the rate limit makes the server useless for mass spam while being more than adequate for legitimate mail. If you're running a personal mail server or small-business email, you'll never hit 25 per minute in normal use.
What to watch for
Contabo's IP reputation is mixed. It's not as poor as ColoCrossing/RackNerd ranges, but Contabo's popularity and low prices mean their IP blocks get more abuse than providers like Hetzner or Netcup. Before configuring your mail server, run your assigned IP through MXToolbox Blacklist Check. If it's listed, open a ticket with Contabo for a replacement IP before you set up anything.
PTR records are configurable through the Contabo customer panel. Set the reverse DNS to match your mail server hostname before sending your first email.
DigitalOcean: no, permanently blocked
DigitalOcean blocks outbound SMTP on ports 25, 465, and 587 for all Droplets created after June 22, 2022. This is not a default that can be toggled off. It's a policy decision.
DigitalOcean's official support page states the reason directly: blocking is done "to prevent spam and other abuses." The documentation doesn't describe an unblock request process. Instead, it recommends using "a third-party email-as-a-service provider" and notes that "self-hosted mail servers are difficult to secure and maintain."
That language tells you everything about DigitalOcean's stance. They've decided self-hosted email is not a use case they want to support. This is a reasonable business decision (their IP reputation stays cleaner), but it means DigitalOcean is a dead end for anyone planning to run their own mail server.
Exceptions
Droplets created before the June 2022 cutoff may still have SMTP access. Some users report that contacting support can occasionally result in an unblock, but this is not documented, not reliable, and not something to plan around.
Side-by-side comparison
| Hetzner | Contabo | DigitalOcean | |
|---|---|---|---|
| Port 25 status | On request | Open | Blocked |
| How to open | Limit request after ~1 month | Works on provision | No practical path |
| Rate limit | None stated | 25/min (1,500/hr) | N/A |
| PTR / rDNS | Self-service (Cloud Console) | Self-service (customer panel) | Self-service (but irrelevant) |
| IP reputation | Good (cleanest budget range) | Mixed (check on provision) | Good (but you can't send) |
| Time to first email | ~30 days | ~30 minutes | Never |
| Best for email? | Yes (long-term best) | Yes (fastest start) | No |
Which one to pick for email
If you can wait a month: Hetzner. The cleaner IP ranges are worth the patience. Set up the server, configure everything except the mail server, and submit your limit request on day 30. Use a relay service in the interim if you need email before then.
If you need email today: Contabo. Port 25 works immediately. Check your IP against blacklists, set the PTR record, configure SPF/DKIM/DMARC, and you're sending within an hour. The 25/min rate limit is not a problem for normal mail volumes.
If you're on DigitalOcean for other reasons: Don't try to fight the SMTP block. Use DigitalOcean for your application server and route all outbound email through a third-party relay (Mailgun, SendGrid, Amazon SES via port 587). This is what DigitalOcean's own documentation recommends, and it's the correct approach on their platform.
For the full picture of which providers open, restrict, and block port 25, see the complete port 25 policy map covering 16 providers. For why port 25 alone doesn't guarantee deliverability, see why your self-hosted email still goes to spam.
FAQ
Does Hetzner allow port 25?
Yes, but not immediately. Port 25 is blocked for the first month. After ~30 days and one paid invoice, submit a limit request in the Cloud Console with your use case. Most legitimate requests are approved. The wait keeps Hetzner's IP ranges cleaner than providers that open port 25 instantly.
Does Contabo allow port 25?
Yes, by default. Port 25 works on Contabo VPS from the moment of provisioning. The only restriction is a rate limit of 25 emails per minute (1,500/hour), which is more than enough for personal and small-business mail. Check your IP against blacklists before configuring your mail server.
Does DigitalOcean allow port 25?
No. DigitalOcean blocked SMTP ports 25, 465, and 587 on all new Droplets since June 2022. No documented unblock process exists. They recommend third-party email services. Self-hosted email is not a supported use case on DigitalOcean.
Which of these three is best for self-hosted email?
Hetzner for the long term (clean IPs, worth the month wait). Contabo for immediate access (open today, check IP first). DigitalOcean is not an option for self-hosted email.