Port 25 – SMTP (Simple Mail Transfer Protocol)

Port 25 is the default port for SMTP, the protocol mail servers use to relay email to one another across the internet. It’s the transport between mail transfer agents (MTAs) — not the port your mail client uses to send. By default the conversation starts in cleartext, and TLS is only added if both ends negotiate STARTTLS, so an open port 25 both identifies a live mail server and hands you a plaintext session to probe.

Why It’s Open

Every host that accepts inbound mail — the MX for a domain — listens on port 25. You’ll find Postfix, Exim, and Sendmail behind the vast majority of them, with Microsoft Exchange edge transports and appliances like Barracuda or Proofpoint making up much of the rest. It has to be reachable from any sending server, so on an MX host it’s legitimately internet-facing.

What changed is outbound 25. To slow spam from compromised machines, most ISPs and cloud providers (AWS, Google Cloud, Azure) block outbound port 25 from ordinary hosts and push clients to authenticated submission on port 587 or SMTPS on port 465 instead. So a port 25 that answers on a workstation, a database box, or anything that isn’t a mail gateway is worth a second look — it’s often a forgotten test relay or a device shipped with an MTA enabled.

Common Risks

• Open relay. An MTA that accepts mail from anyone and delivers it anywhere lets attackers send spam and phishing through your IP. The reputation damage and blocklisting outlast the fix.
• User enumeration. VRFY, EXPN, and per-recipient RCPT TO responses let you confirm which usernames exist before any login — useful for building a target list for password spraying elsewhere.
• STARTTLS stripping. If TLS isn’t enforced, a MITM can drop the STARTTLS capability from the server’s reply and force the session back to cleartext, exposing credentials and message content.
• Banner and version disclosure. The greeting and EHLO response usually name the MTA and version, which maps straight to known CVEs.
• Spoofing. Without SPF, DKIM, and DMARC, port 25 will happily accept forged sender addresses — the basis of most business email compromise.
• Remote code execution in the MTA itself. Exim and Sendmail have shipped pre-auth RCE bugs reachable purely by talking SMTP (see CVEs below).

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Check if it’s open, grab the banner, and probe capabilities

nmap -sV -p 25 --script=smtp-commands,smtp-open-relay,smtp-enum-users,smtp-ntlm-info <target>

Raw banner grab with netcat

nc -nv <target> 25

Interactive session — read the EHLO capabilities

telnet <target> 25
EHLO attacker.test

Look at the 250- lines: STARTTLS tells you whether TLS is even offered, AUTH lists the login mechanisms, and VRFY/EXPN being enabled is an enumeration gift.

Test STARTTLS and inspect the certificate

openssl s_client -connect <target>:25 -starttls smtp

Enumerate users with VRFY / RCPT

telnet <target> 25
EHLO attacker.test
VRFY root
VRFY nonexistentuser
MAIL FROM:<probe@attacker.test>
RCPT TO:<admin@target.test>

Distinct replies for valid vs. invalid recipients (250 vs. 550) confirm a working user oracle. Automate it with smtp-user-enum:

smtp-user-enum -M RCPT -U users.txt -t <target>

Check for an open relay

telnet <target> 25
EHLO attacker.test
MAIL FROM:<spam@attacker.test>
RCPT TO:<victim@external-domain.com>

If a message addressed to an external domain from an external sender is accepted (250 Ok), the server is relaying.

Brute-force authentication with Hydra

hydra -L users.txt -P passwords.txt smtp://<target>

Metasploit modules

msfconsole -q
use auxiliary/scanner/smtp/smtp_version
set RHOSTS <target>
run

use auxiliary/scanner/smtp/smtp_enum
set RHOSTS <target>
set USER_FILE users.txt
run

Log every open relay, valid user, and MTA version as you confirm it, so the findings land in the pentest report with the exact SMTP transcript attached instead of scrolling out of your terminal.

What to Look For

Known CVEs and Exploits

• CVE-2019-10149 — “Return of the WIZard.” Improper validation of the recipient address in Exim 4.87–4.91 gives remote command execution as root, triggered by a crafted RCPT TO. Wormed in the wild within weeks; Metasploit ships exploit/linux/smtp/exim4_string_format and it’s archived on Exploit-DB.
• CVE-2020-28018 — Use-after-free in Exim before 4.94.2 (one of the Qualys “21Nails” set) leading to remote code execution on servers using TLS.
• CVE-2023-51764 — SMTP smuggling in Postfix (with sibling CVE-2023-51766 in Exim and CVE-2023-51765 in Sendmail). Inconsistent end-of-data handling lets an attacker smuggle a second message and spoof senders past SPF/DKIM/DMARC.
• CVE-2011-1720 — Memory corruption in the Postfix SMTP server during SASL authentication (mechanisms other than PLAIN/LOGIN), causing denial of service. See the Postfix advisory.

Mitigation

• Lock down relaying so the server only accepts mail for its own domains or from authenticated senders (smtpd_relay_restrictions in Postfix).
• Disable VRFY and EXPN (disable_vrfy_command = yes) to kill the user oracle.
• Enforce TLS. Require STARTTLS for authentication and reject cleartext logins; keep client submission on 587 / 465, not 25.
• Hide the version in the banner (smtpd_banner) so it doesn’t advertise a CVE.
• Patch the MTA promptly — the Exim and SMTP-smuggling bugs above were all fixed upstream well before mass exploitation slowed.
• Publish and check SPF, DKIM, and DMARC to stop spoofing and smuggling.
• Firewall port 25 so only your MX hosts expose it, and keep outbound 25 closed on everything that isn’t a mail server.

Real-World Example

In June 2019 the NSA warned that Sandworm — Russia’s GRU Unit 74455 — was exploiting CVE-2019-10149 against internet-facing Exim servers, using nothing but a crafted MAIL FROM/RCPT TO on port 25 to run code as root, add privileged users, and pull down follow-on scripts. Separate cryptomining worms hit the same bug at scale the same summer. Exim runs on a large share of the internet’s mail servers, so a single unauthenticated SMTP command turned into one of the most widely exploited mail-server vulnerabilities of the decade.

FAQ

What is port 25 used for?

Port 25 is the default SMTP port for relaying email between mail servers (MTA to MTA). When one mail server delivers a message to another domain’s server, that hand-off happens over port 25. It’s the transport layer of email delivery, not the port your mail app uses to send.

Is port 25 dangerous?

On an MX host it’s a necessary, legitimate service — the risk is misconfiguration, not the port itself. An open relay, exposed VRFY/EXPN, unenforced TLS, or an unpatched Exim/Sendmail build all turn port 25 into a real problem. On any host that isn’t a mail server, an open port 25 is worth investigating.

What is the difference between port 25, 587, and 465?

Port 25 is server-to-server relay. Port 587 is authenticated submission — the port a mail client uses to send outgoing mail, with STARTTLS. Port 465 is submission wrapped in TLS from the first byte (SMTPS). Clients should use 587 or 465; 25 is for the servers in between.

How do I close port 25?

If the host isn’t a mail server, stop and disable the MTA (systemctl disable --now postfix / exim / sendmail) and firewall TCP/25. On a real MX you keep it open but restrict relaying, enforce TLS, and limit outbound 25 to the mail gateway. Rescan with nmap -p 25 <target> to confirm the state.

TL;DR

• Service: SMTP (server-to-server email relay)
• Default port: 25/TCP
• Biggest risk: open relay + pre-auth MTA RCE (e.g. Exim CVE-2019-10149)
• Mitigation: restrict relaying, enforce TLS, disable VRFY/EXPN, patch the MTA, publish SPF/DKIM/DMARC