Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Port 25 (SMTP): what it is, how it is attacked and how to secure it

In one sentence: Port 25 is the door that mail servers use to pass email to each other across the internet.

What runs on this port

SMTP, the Simple Mail Transfer Protocol, moves email between servers. RFC 5321 defines it, and the IANA registry lists SMTP on TCP port 25.

Port 25 is for relay, which means one mail server handing a message to the next. RFC 6409 separates this from message submission, the step where a person’s mail app sends a message to their own server. Submission normally uses port 587. Port 465 is for submission with encryption from the first moment (RFC 8314). Also, the STARTTLS extension (RFC 3207) lets a connection upgrade to encryption.

If you use Microsoft 365 or Google Workspace, the provider runs the mail server. You usually do not need port 25 open on your own network.

Why attackers look for it

A mail server on the internet is a known target. It accepts connections from strangers by design, so it cannot hide behind a login.

RFC 5321 is frank about the weakness: SMTP mail is inherently insecure in that casual users can negotiate directly with servers and create messages that trick a naive reader into thinking they came from somewhere else. Real mail security lies in end-to-end methods.

How it gets attacked

  • Spoofed sender addresses. Without anti-spoofing records, attackers can send mail that appears to come from your domain. The NCSC explains that SPF, DKIM and DMARC make this difficult.
  • No encryption in transit. Mail between servers is not always encrypted. The NCSC advises that services should be capable of sending and receiving email using TLS.
  • Server software flaws. CVE-2020-7247: the National Vulnerability Database (NVD) records that OpenSMTPD 6.6 allowed remote attackers to execute arbitrary commands as root via a crafted SMTP session, affecting the default configuration. It scored 9.8 on CVSS v3.1 and is in CISA’s Known Exploited Vulnerabilities catalogue, added 25 March 2022.
  • Credential attacks on mail submission, covered under password spraying.

Who it affects and how badly

  • Sole trader to 10 staff: a spoofed email from your domain to your clients. Worst case: invoice fraud in your name.
  • 10 to 50 staff: accountancy, legal and estate agency firms whose mail is a route to payment fraud.
  • 50 to 250 staff: a self-hosted mail server left unpatched is a way into the whole network.
  • Regulated businesses: the NCSC says securing email reduces the costs of service down-time and the time spent dealing with email fraud, and protects your brand and reputation.

How to check whether yours is exposed

  • Look at your firewall rules for inbound TCP 25, and ask whether you really run your own mail server.
  • Check your MX records to see where mail is delivered.
  • Run the NCSC’s free Email Security Check against your domain to see whether SPF, DKIM, DMARC and TLS are set up.
  • In Microsoft 365, use message trace to see where suspicious mail came from. Review any DMARC reports you receive.
  • Run the free web vulnerability scan and review the results for your own addresses.

How to secure it

  1. Do not run your own mail server unless you have to. A managed provider takes on the patching.
  2. If you must run one, keep it updated, and apply updates for known exploited flaws first.
  3. Publish SPF, DKIM and DMARC for every domain you own, including ones you do not send from (NCSC).
  4. Require TLS between servers where you can (NCSC).
  5. Use port 587 or 465 with authentication for staff mail apps, and keep relay on port 25 locked down.
  6. Use multi-factor authentication on every mailbox.
  7. Block inbound port 25 to any device that is not a mail server.
  8. Monitor mail logs for spikes in outbound mail.

Related terms

Frequently asked questions

What is port 25 used for?
Relay of email between mail servers. IANA lists SMTP on TCP port 25, and RFC 6409 puts staff mail submission on port 587.

Do I need port 25 open if I use Microsoft 365?
Usually not on your own network, because the provider runs the mail server.

What stops people spoofing my domain?
The NCSC says SPF, DKIM and DMARC, correctly configured, make it difficult for fake emails to be sent from your domain.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.