dotvitals

Mail server does not accept connections on port 25

CriticalHigh confidenceemail.smtp-tls.port-unreachable

What this check looks for

Your mail server did not answer on the port email is delivered to. If this is not a temporary fault, inbound mail to this domain is not arriving.

Why it matters

Sending servers retry for a few days and then give up, returning the message to its sender. The failure is silent for you: nothing appears in your mailbox, because nothing reached it.

When the check passes, your report says: “The mail server accepts connections on port 25”.

What it costs your score

When this check fails it removes 30 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.

It shares the email-transport.smtp-tls family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.

Severity
critical
Default confidence
high
Status when triggered
fail
Deduction
30 points
Family cap
email-transport.smtp-tls · 40
Category
Email transport
Module
Email smtp tls
Fix owned by
mail provider
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Make port 25 reachable on ‹mx host›, or point the MX record at a host that answers.

A mail server that does not answer on port 25 receives no mail at all.

  1. Check the service is running and listening: ss -lntp | grep :25 on the server.

  2. Check the firewall permits inbound TCP/25 from anywhere, not only from known hosts — any server on the internet may deliver to you.

  3. Check your provider's network policy; some cloud platforms block inbound port 25 by default and require a support request to open it.

  4. If this host is not meant to receive mail, remove or repoint the MX record that names it.

How to confirm it worked

  • nc -vz ‹mx host› 25 — expect a connection and a 220 greeting.

  • Send a test message from an external account and confirm it is delivered.

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

A connection to ‹mx host› (‹address›) on port ‹port› did not succeed: ‹reason›. RFC 5321 §2.3.9 defines port 25 as the port for message relay between servers; a firewall that only permits submission ports 587/465 does not accept inbound mail.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email smtp tls checker

Other email smtp tls checks