VPS Port 25 Policy Map 2026: Which Providers Open SMTP (And Which Never Will)

The policy map

Every provider falls into one of three tiers. "Open" means port 25 works on a fresh VPS with no action beyond standard server configuration. "On request" means it's blocked by default but unblockable, either self-service or via support ticket. "Blocked" means there's no practical path to opening it.

Not listed: InterServer's port 25 policy could not be confirmed from official documentation or reliable community sources at time of writing. If you have first-hand data, let us know.

Tier 1: Open by default

These providers let you send on port 25 the moment your VPS is provisioned. No ticket, no waiting period, no control-panel toggle. The trade-off is usually IP reputation.

RackNerd

RackNerd is the most commonly recommended "just works" option for self-hosted email. Port 25 is open, PTR records are configurable in the client panel, and the annual pricing is the cheapest in this tier. The catch is ColoCrossing. RackNerd uses ColoCrossing infrastructure, and ColoCrossing IP ranges are frequently listed on UCEProtect and other blacklists because of the volume of spam that's historically originated from their network. Your brand-new RackNerd IP may already be on a blacklist before you send your first email. Check before you configure anything: run the IP through mxtoolbox.com/blacklists.aspx and request a new one if it's listed.

Contabo

Contabo opens port 25 by default with a rate limit of 25 emails per minute (1,500 per hour). That's more than enough for a personal or small-business mail server. Contabo's IP reputation is generally cleaner than RackNerd's because they enforce the rate limit rather than leaving it wide open. The rate limit itself is the product doing the spam prevention that other providers achieve by blocking port 25 entirely. For transactional email and normal correspondence, 25 per minute is not a constraint you'll notice.

DartNode

DartNode is a newer budget provider that opens port 25 by default. The twist is they monitor outbound reputation automatically: if your IP lands on a DNS blacklist, DartNode disables SMTP on that IP until you get delisted and contact their support. It's an interesting middle ground between "open and forget" (RackNerd) and "blocked until you ask" (Hetzner). The monitoring means a compromised instance gets cut off before it burns the IP range for everyone else.

Hostinger

Hostinger technically opens port 25 on their VPS plans, but the rate limit of 5 emails per minute (300 per hour) makes it impractical for most mail server use cases. If you're sending more than a handful of transactional emails, the limit will throttle you hard. If all you need is a few cron-job notifications, it works. For an actual mail server, look elsewhere.

Tier 2: Open on request

These providers block port 25 by default but offer a path to open it. The path varies from "click a button in the control panel" to "wait a month and write a support ticket." The distinction matters.

Self-service unblock

Netcup includes a default firewall rule that blocks SMTP on their G12 and later vServer lines. To remove it: Server Control Panel, Firewall section, trash-can icon next to the "netcup Mail block" policy. Done. No support interaction, no waiting. This is the fastest "on request" path, and Netcup's IP reputation in European networks is generally solid.

Scaleway blocks SMTP ports (25, 465, 587) at the security-group level. You can edit the rules in the Scaleway console to allow outbound SMTP. The process is documented, but scattered across their instance and Elastic Metal docs, and the documentation doesn't make it obvious that this is the fix when your mail server can't send.

Support ticket required

Hetzner is the gold standard for self-hosted email if you're willing to wait. Port 25 is blocked for the first month. After you've been a customer for roughly 30 days and paid your first invoice, you submit a "limit request" in the Cloud Console explaining your use case. Approval is case-by-case, but most legitimate mail server requests get through. The wait period is the point: it filters out throwaway spam accounts. The payoff is that Hetzner's IP ranges are significantly cleaner than most budget providers, and PTR records are settable in the Cloud Console dashboard. If you're planning a mail server for the long term, the month of patience is worth it.

Vultr blocks port 25 on all new instances and reviews unblock requests via support ticket. Approval is case-by-case. Community reports on the success rate are mixed, and at least one GitHub discussion from 2023 claims Vultr stopped approving unblock requests entirely, though Vultr's official docs still describe the process as available. If Vultr is your preferred provider, submit the ticket early so you're not blocked mid-setup.

BuyVM (Frantech) blocks all SMTP-related ports by default, including 25, 465, 587, and 2525. The wiki FAQ is direct about it: "The only blocked ports are the SMTP (Mail) ports, which can be unblocked by creating a support ticket." BuyVM's support response times have been inconsistent in recent years (the Cloudzy acquisition has added uncertainty), so factor in potential delays.

Linode / Akamai has blocked outbound SMTP on "some new accounts" since November 2019. The phrasing is deliberately vague. If your fresh Linode can't send on port 25, contact support for an unblock. The process is documented in Akamai's tech docs and generally straightforward. Older accounts that predated the November 2019 cutoff are typically unaffected.

OVHcloud blocks port 25 on VPS by default. Unblock via support request or through the management interface, depending on the product line. OVHcloud's dedicated servers have historically been more permissive than their VPS line, and the company's email-sending documentation focuses heavily on relay services rather than direct SMTP.

Tier 3: Blocked, don't bother

These providers have made a policy decision: self-hosted email is not a supported use case on their platform. Don't sign up expecting to change their mind.

DigitalOcean is the most notable name here. As of June 22, 2022, all new Droplets have ports 25, 465, and 587 blocked. Their official docs don't describe an unblock process. Instead, the documentation states that "self-hosted mail servers are difficult to secure and maintain" and recommends third-party services. This is a permanent policy shift, not a temporary anti-abuse measure. If you have a DigitalOcean Droplet provisioned before June 2022, you may still have SMTP access. New accounts will not.

Oracle Cloud blocks port 25 on all compute instances. Community consensus is that there's no unblock path. The free tier that attracts many self-hosters comes with this restriction baked in.

AWS Lightsail blocks port 25 by default. AWS documentation describes a request process through AWS support, but approvals are rare and the process is slow. Amazon's own SES product is the intended email path. If you're on AWS for other reasons and need email, use SES, not port 25.

Google Cloud blocked all outbound traffic on port 25 starting January 2020. No exceptions, no request process. Their documentation is explicit: use a relay service.

Azure blocks outbound SMTP on port 25 for most subscription types, particularly pay-as-you-go and trial subscriptions. Enterprise agreements may have different terms, but for individual self-hosters, it's effectively blocked.

Port 25 isn't enough

This is the part that catches people after they've solved the port 25 question. Having an open port is necessary but not sufficient for email that actually reaches inboxes.

Three things will still get your mail rejected even with port 25 wide open:

1. IP reputation. If your VPS IP address is on a DNS blacklist (Spamhaus, UCEProtect, Barracuda), Gmail and Outlook will reject your mail regardless of your configuration. RackNerd's ColoCrossing ranges are the textbook example: port 25 is open, but the IPs are frequently listed. Always check mxtoolbox.com/blacklists.aspx with your IP before configuring anything.
2. PTR / rDNS records. Your IP's reverse DNS must resolve to your mail server's hostname, and that hostname must resolve forward to the same IP. Without this, many receiving servers reject on principle. Most providers in the table above support PTR configuration, but the process varies: some have it in the control panel, others require a support ticket.
3. SPF, DKIM, DMARC. Since Google's February 2024 sender requirements, bulk senders must have all three configured. Even for small senders, missing DKIM or a misconfigured SPF record will land your mail in spam. This is configuration on your side, not a provider policy, but it's the reason "port 25 open" alone doesn't mean "email works."

How this data was gathered

Every entry in the table above comes from one of four source types:

• Official provider documentation (e.g. DigitalOcean's support page, Vultr's docs, Hetzner's community guides, Netcup's help center).
• Provider FAQ or wiki pages (e.g. BuyVM/Frantech wiki FAQ).
• Community reports with consensus: multiple independent accounts on Reddit r/selfhosted, LowEndTalk, or Mail-in-a-Box forums describing the same policy. Single anecdotes are not used as sole sources.
• The awesome-mail-server-providers GitHub repository, a community-maintained comparison table that cross-references many of these policies.

Where a policy could not be confirmed from any of these sources (InterServer), the provider is omitted rather than guessed. Policies change. If you find a discrepancy, send a correction and we'll update the table.

FAQ