Outbound TCP port 25 is now blocked by default on ZCP compute instances.
The policy protects the sender reputation of shared IP ranges. Spam or a compromised instance that sends mail directly over port 25 can affect delivery for other customers using the same range.
What changes
| Traffic | Status |
|---|---|
| Outbound TCP 25, IPv4 | Blocked by default |
| Outbound TCP 25, IPv6 | Blocked by default |
| Outbound TCP 465 and 587 | Open |
| Inbound TCP 25 | Open |
The policy applies only to outbound TCP port 25. It does not change inbound SMTP or authenticated SMTP on ports 465 and 587.
Send email through an authenticated relay
For application email, use an authenticated SMTP relay or transactional email provider on port 587 or 465. These ports are open by default.
This approach also gives you delivery retries, bounce handling, and a sender reputation managed for your sending domain. Common providers include Amazon SES, Postmark, Mailgun, SendGrid, and Brevo.
If you run WordPress, Drupal, LAMP, LEMP, or cPanel, configure the application or mail server to use your relay. The local mail transfer agent in these images sends directly over port 25 unless you change its configuration.
Request an exception for a production mail server
Verified customers operating a production mail server may request outbound port 25 access. We review each request based on its intended use and sending history.
Open a support request from the cloud console or email the support team. Include:
- Your account name.
- The public IP addresses that need access.
- Your expected mail volume and use case.
- Confirmation that SPF and DKIM are configured for the sending domain.
- The reverse DNS hostname you want for each IP address.
We set the PTR record for every approved IP address. Most receiving mail servers expect a valid PTR record that resolves to your sending domain.
Read the full policy
The SMTP Port 25 documentation has the complete policy and request details.