TCP Port 25 – SMTP (Simple Mail Transfer Protocol)
Port 25 is the original port for SMTP, the Simple Mail Transfer Protocol that moves email between mail servers across the internet. When one mail server sends a message to another, the sending server connects to TCP port 25 on the receiving server and delivers the message using the SMTP commands defined in RFC 5321. This protocol has been the backbone of internet email since it was first specified in 1982.
In modern email infrastructure, port 25 is reserved for server-to-server traffic. Client applications, like Outlook or Thunderbird sending mail through a provider, use port 587 for submission instead. Port 587 is the dedicated submission port and requires authentication; port 25 between providers historically did not. Encrypted submission can also run on port 465, the legacy SMTPS port. Together, these three ports cover almost all real-world email traffic.
Most residential internet providers block outbound TCP port 25 from home networks. This is not because the protocol is broken, but because home machines sending directly on port 25 are almost always compromised devices participating in spam botnets. Legitimate home users send mail through their provider’s submission server on port 587, which is unaffected by these blocks.
Port 25 is also defined for UDP in the IANA registry, but UDP/25 is not used in practice. SMTP requires the reliable, ordered delivery that TCP provides, and no major mail server software uses UDP for SMTP transport.
Seeing inbound TCP/25 to a host that is not an authorized mail server is unusual and worth investigating. Outbound TCP/25 from a typical end-user device is also uncommon, given the residential blocks described above.
About TCP Port 25
The Internet Assigned Numbers Authority (IANA) registers port 25 for smtp. The IANA description reads: ‘Simple Mail Transfer’.
Security Considerations
A mail server exposed on port 25 is a high-traffic target. Spam senders, malware distributors, and credential harvesters routinely scan the internet for SMTP servers they can abuse. Our data shows 228 IDS rules referencing this port, with trojan-activity and reconnaissance categories leading the count, consistent with the protocol’s role as a primary malware delivery vector. Several well-known threats appear in rules tied to port 25, including MiniDuke (associated with the APT29 espionage group), the HawkEye keylogger, the Lockergoga ransomware family, and the Dridex banking trojan.
Two attack patterns dominate. First, spam and phishing campaigns deliver malware-laden attachments or credential-harvesting links through mail traffic that traverses port 25 between sending and receiving servers. Second, attackers probe SMTP servers directly for misconfiguration: open relays that will accept mail from anyone, vulnerable mail server software like older Sendmail and Exchange versions, and authentication weaknesses. Several rules in our dataset target specific historical issues, including reconnaissance attempts that exploit the EHLO and EXPN commands used by older scanning tools like CyberCop, and overflow attacks against legacy Sendmail and MailMax server software.
Modern email infrastructure addresses these risks at multiple layers. Sender authentication frameworks (Sender Policy Framework or SPF, DomainKeys Identified Mail or DKIM, and Domain-based Message Authentication Reporting and Conformance or DMARC) make it harder to spoof sending domains. STARTTLS encrypts SMTP sessions in transit. Mail server software has matured, and major spam-filtering providers maintain real-time blocklists of known-bad sending IPs. Common practice for organizations is to run mail servers behind well-tuned anti-spam appliances or cloud filtering services, rather than exposing raw SMTP directly.
If you see inbound TCP/25 connections to a machine that is not a designated mail server, that warrants investigation. Outbound TCP/25 from an end-user workstation, particularly to many destinations in a short window, is a classic indicator of a spam-sending malware infection.
IDS Rule References
226 IDS / security rules reference TCP port 25. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): trojan-activity (52), misc-activity (51), attempted-admin (34), attempted-recon (34), attempted-user (17), targeted-activity (13).
Sample rule descriptions for TCP port 25:
- SERVER-MAIL sniffit overflow
- SERVER-MAIL x86 windows MailMax overflow
- SERVER-MAIL battle-mail traffic
- SERVER-MAIL SMTP relaying denied
- SERVER-MAIL ehlo cybercop attempt
Malware Activity
A meaningful share of monitored traffic on this port involves malware indicators.
69 of 226 IDS rules for TCP port 25 involve malware activity.
Families observed (top 8): APT29_MiniDuke (12), HawkEye (6), Lockergoga (3), Bancos (2), Delf (2), iSpy (2), LDPinch (2), Mumblehard (2), and 28 more families.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).