25

Port 25/tcp is the original home of the Simple Mail Transfer Protocol and remains the channel for server-to-server mail relay (MTA→MTA) and final delivery across the internet. SMTP is a text-based "push" protocol — a client issues HELO/EHLO, MAIL FROM, RCPT TO, and DATA, and the server accepts or rejects the message — and on port 25 that exchange happens between mail servers reached via DNS MX records, not between an end user's client and their provider. Crucially, since RFC 6409 and RFC 8314, port 25 is *not* intended for authenticated client submission; that role belongs to 587 (STARTTLS) and 465 (implicit TLS). Encryption on 25 is opportunistic via STARTTLS (RFC 3207), optionally enforced with MTA-STS or DANE, and server-to-server trust rests on SPF/DKIM/DMARC rather than credentials. Historically port 25 was the internet's principal spam and malware vector: open-relay misconfigurations let anyone send mail through a server, and large spam botnets delivered directly to MX hosts on 25 — which is why residential ISPs almost universally block outbound 25 (the Spamhaus/M3AAWG "port 25 management" practice). For an analyst, an open 25/tcp usually indicates an inbound MTA or mail gateway; the high-value triage steps are banner-grabbing the server software, testing for an open relay, checking whether STARTTLS is offered, and confirming AUTH is not exposed in cleartext.

IANA assignment

smtp — "Simple Mail Transfer"; reference [RFC-ietf-emailcore-rfc5321bis-43] (the in-progress RFC 5321bis revision the registry currently tracks); assignee IESG/IETF Chair; modified 2017-06-05. Governing published standard: RFC 5321

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 0.131314 — the most common port in the mail cluster [Well-established] — nmap-services file

Related ports

587 (submission + STARTTLS), 465 (submission + implicit TLS); 2525 (unofficial)

Primary use

server-to-server mail relay (MTA→MTA) and final delivery; not authenticated client submission (use 587/465)

Other/unofficial uses

legacy authenticated submission (discouraged); unofficial fallback port 2525 (not IANA/IETF-recognized)

Security implications

open-relay abuse; spam-botnet direct-to-MX delivery (cause of residential ISP outbound-25 blocking, per Spamhaus/M3AAWG); STARTTLS downgrade/stripping; cleartext AUTH discouraged

Typically seen on

inbound MTAs, mail gateways, spam filters (Postfix, Sendmail, Exchange, Exim, Qmail, Zimbra)

Analyst note

Open 25/tcp usually means an inbound MTA/mail gateway. Banner-grab the server type, test for open relay (e.g., nmap smtp-open-relay), check STARTTLS support, and check whether AUTH is offered in cleartext.

Port 25/udp is registered with IANA as smtp with the description "Simple Mail Transfer," assignee [IESG], contact [IETF_Chair], and reference [RFC-ietf-emailcore-rfc5321bis-43] (the modification date in the registry is 2017-06-05; the registration-date column is blank). Port 25 is dual-registered: the same smtp service name and description cover both 25/tcp and 25/udp. The operationally meaningful assignment is the TCP one — SMTP, the protocol that moves mail between servers, runs exclusively over TCP because it needs a reliable, ordered byte stream for its command/response dialog, and UDP provides neither delivery guarantees nor ordering. The UDP registration is a registry formality with no protocol behind it: no RFC defines SMTP over UDP, and no known mail software listens on 25/udp. The current SMTP base specification under revision, draft-ietf-emailcore-rfc5321bis (in the RFC Editor queue as of mid-2025, and the source of the rfc5321bis-43 reference slug), still states SMTP requires a reliable ordered data-stream channel and documents TCP as the transport — it defines no UDP mode. For an analyst this means a responsive or scanned 25/udp is essentially never a real SMTP service; the well-known port-25 ecosystem — MTA software (Postfix, Sendmail, Exim, Microsoft Exchange, Qmail, OpenSMTPD), ISP and cloud-provider outbound blocking to curb spam, open-relay botnet abuse (Cutwail, Rustock, Necurs), and CVEs such as CVE-2023-51765 (Exim) and CVE-2020-14386 (Postfix) — is all TCP-side. Internet-wide scanners (Shodan, Censys) index 25/tcp heavily; 25/udp produces negligible scan signal because nothing answers there. Treat an open 25/udp as an anomaly, a misconfiguration, or a decoy rather than mail transport, and pivot to 25/tcp (and 587/465) for any actual SMTP investigation.

IANA assignment

smtp — "Simple Mail Transfer"; assignee [IESG]; contact [IETF_Chair]; reference [RFC-ietf-emailcore-rfc5321bis-43]; modification date 2017-06-05; registration-date column blank; dual-registered 25/tcp + 25/udp

[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (CSV + xhtml)

Range class

well-known (0–1023) [Confirmed] — IANA registry

Related ports

25/tcp (the active SMTP relay port); 587 (submission); 465 (SMTPS)

Primary use (UDP)

none in practice — UDP/25 is a co-registered registry formality; SMTP requires a reliable ordered data-stream channel and runs only over TCP

Protocol over UDP

Unknown / none defined — no RFC or specification defines SMTP over UDP, and rfc5321bis (the referenced draft) specifies TCP, not UDP

Exposure / scanning

scanners (Shodan, Censys, ShadowServer) index 25/tcp broadly; 25/udp generates negligible scan hits because nothing listens; ISPs and cloud providers (AWS, GCP, Azure) block outbound 25/tcp to curb spam

Security implications

port-25 abuse and CVEs are TCP-only — open-relay botnets (Cutwail, Rustock, Necurs); CVE-2023-51765 (Exim TLS), CVE-2020-14386 (Postfix). No CVEs specific to 25/udp are documented

Typically seen on

nothing legitimate on UDP; an open 25/udp is an anomaly / misconfiguration / possible decoy

Associated software

MTA software is bound to 25/tcp (Postfix, Sendmail, Exim, Microsoft Exchange, Qmail, Zimbra, hMailServer, Courier, Kerio Connect, OpenSMTPD); no software is known to use 25/udp [Likely] — https://scanitex.com/en/resources/ports/tcp/25

Historical context

SMTP's port-25 assignment dates to RFC 821 (1982); client submission has since shifted to 587 (RFC 6409) and 465 (RFC 8314). UDP/25 has no separate historical usage narrative [Likely] — https://prospeo.io/s/port-smtp ; https://mailtrap.io/blog/smtp-ports-25-465-587-used-for/

Analyst note

A responsive 25/udp is statistically rare and not real SMTP — treat as an anomaly and pivot to 25/tcp (and 587/465) for actual mail-flow investigation.