Why DigitalOcean Is the Worst VPS Choice for Self-Hosted Email
DigitalOcean blocks ports 25, 465, and 587 on every Droplet. Not temporarily. Not for new accounts. Permanently, for everyone, since June 2022. There is no unblock form. There is no support ticket that will help. If you sign up for a DigitalOcean VPS to run a mail server, you have bought a machine that is physically incapable of sending email the way email works.
This isn't buried in fine print. DigitalOcean's documentation explicitly states it: they block SMTP ports and recommend using third-party transactional email services instead. The community forums are full of developers who discovered this after spinning up a Droplet, configuring Postfix, and wondering why nothing was sending.
What exactly is blocked
The block covers all three SMTP-related ports:
- Port 25 (SMTP) — the standard mail transfer port used for server-to-server delivery
- Port 465 (SMTPS) — legacy implicit TLS port, still used by some clients and servers
- Port 587 (submission) — the port mail clients use to submit outbound messages
This is more aggressive than most providers. Vultr and AWS block port 25 but leave 587 open. DigitalOcean blocks all three. This means you cannot run any mail server component that sends email directly, regardless of which port you configure it on.
The block is applied at the network/hypervisor level, not inside the Droplet. You can install Postfix, configure it perfectly, and see zero errors in the logs until you realize no packets on those ports leave the machine.
Why DigitalOcean did this
DigitalOcean was, for years, one of the most abused cloud platforms for spam. The combination of easy sign-up, hourly billing, API-driven provisioning, and no email verification made it trivial to automate: create account, spin up Droplet, blast spam, abandon, repeat. Abuse teams at receiving mail servers learned to treat entire DigitalOcean IP ranges with suspicion.
DigitalOcean tried case-by-case enforcement first. They'd restrict SMTP on new accounts and require a support ticket to unblock. This created an arms race: spammers would submit tickets with plausible-sounding requests, get unblocked, send spam, and burn the IP. The support overhead was enormous, and it wasn't working.
In June 2022, DigitalOcean gave up and blocked SMTP entirely. Their official position became: use a managed email relay (SendGrid, Mailgun, Postmark, Amazon SES) for transactional email, and use Google Workspace or Microsoft 365 for business email. Self-hosted email is no longer a supported use case.
The workarounds (and why they miss the point)
The standard advice in DigitalOcean community forums is to relay through a third-party SMTP service:
- Use SendGrid's SMTP relay on port 2525 (which isn't blocked)
- Use Mailgun's HTTP API instead of SMTP
- Use Amazon SES as a smarthost
These work in the narrow sense that email leaves your server and reaches inboxes. But they defeat the entire purpose of self-hosting email. Your mail passes through a third party's infrastructure. They can read it, log it, and you're subject to their terms of service and rate limits. You're paying for a VPS to run a mail server that doesn't actually send mail — it hands off to someone else who sends it.
If you're going to relay through SendGrid, you don't need a VPS at all. You need a SendGrid account.
VPN tunnels (routing SMTP traffic through a VPN endpoint on another server) are sometimes suggested. This technically works but adds a dependency on a second server that does have port 25 open. At that point, you should just run your mail server on that second server.
The irony: DigitalOcean's IPs are cleaner because of this
Here's the counterintuitive part. Because DigitalOcean blocks all SMTP, their IP ranges have actually improved in email reputation since 2022. No spam originates from DigitalOcean IPs anymore, so blacklist entries have aged out. If DigitalOcean ever reversed the policy, their IPs would be among the cleanest in the VPS industry.
They won't reverse it. The economics don't work. Supporting self-hosted email means supporting abuse complaints, IP reputation management, and reverse DNS configuration for customers who may or may not know what they're doing. DigitalOcean decided the revenue from email self-hosters wasn't worth the operational cost.
What to use instead
If self-hosted email is the goal, pick a provider that actually supports it. The trade-offs between them come down to price, friction, and IP reputation:
| Provider | Port 25 | Friction | IP reputation | Starting price |
|---|---|---|---|---|
| Contabo | OPEN | None (25/min rate limit) | Moderate | ~$7/mo |
| RackNerd | OPEN | None | Poor (ColoCrossing) | ~$11/yr |
| Hetzner | ON REQUEST | ~1 month wait | Good | €4.51/mo |
| Vultr | ON REQUEST | Support ticket + review | Moderate-Good | $5/mo |
| BuyVM | ON REQUEST | Support ticket | Good (smaller pool) | $3.50/mo |
For the complete picture of who blocks, who opens, and who sits in between, see the full port 25 policy map. For recommendations ranked by email deliverability rather than price, see best VPS for self-hosted email.
FAQ
Does DigitalOcean block port 25?
Yes. Ports 25, 465, and 587 are all blocked on every Droplet since June 2022. The block is permanent with no unblock process. DigitalOcean recommends third-party email services instead.
Can I use a relay to send email from DigitalOcean?
You can relay through SendGrid/Mailgun via port 2525 or their API. But this defeats the purpose of self-hosting — your mail passes through a third party. If you need a relay, you don't need a VPS.
Why did DigitalOcean block all SMTP ports?
Years of spam abuse. Easy sign-up + hourly billing made DO a target for disposable spam servers. Case-by-case enforcement failed, so they blocked all SMTP permanently in June 2022.
Which VPS providers still allow self-hosted email?
Contabo and RackNerd open port 25 by default. Hetzner, Vultr, and BuyVM unblock on request. See the full port 25 policy map for 16 providers.