SMTP connection timed out: why port 25 (or 587) hangs and how to fix it
A timeout means nothing answered: outbound port 25 blocked by the cloud/ISP (DigitalOcean, Vultr, Azure, Comcast), Linode blocking 25/465/587 on new accounts, a host firewall, a proxied (Cloudflare) mail hostname, or a wrong host. Diagnosis steps and fixes.
What timeout means: Your TCP SYN got no reply at all — not a refusal, silence. Something between you and the server drops the traffic, or the host does not exist at that address.
Causes, most likely first — and the fix for each
- Outbound port 25 is blocked by your provider: DigitalOcean, Vultr, Azure, Google Cloud, Hetzner Cloud (new accounts), most home ISPs.
Fix: Do not deliver directly on 25; relay through an authenticated SMTP provider on 587 or 465. - Linode/Akamai blocks 25, 465 AND 587 on newer accounts.
Fix: Use port 2525 to the relay until support lifts the block. - Corporate/office firewall allows only web ports.
Fix: Use 465 or 2525, or ask IT to open 587. - The mail hostname is proxied through Cloudflare (orange cloud) — SMTP to it goes nowhere.
Fix: Set the mail record to DNS-only (grey cloud). - Wrong host/port (typo, IMAP host used for SMTP, receiving MX used for sending).
Fix: Copy the exact outgoing host from the provider's settings page. - IPv6: the client prefers an AAAA record and IPv6 is broken on the server.
Fix: Fix IPv6 or force IPv4 (Node --dns-result-order=ipv4first, Python/Java socket options).
How to confirm which one you have
From the server: nc -vz smtp.queensmtp.com 587 (then 465, 2525, 25). Whichever answers is the port to use; a hang on 25 alone is the classic cloud block.
Open the SMTP tester Check SPF / DKIM / DMARC
Still stuck? Use a relay that tells you why
QueenSMTP shows every message's exact server reply in the log, verifies your domain's SPF and DKIM before you send, and is not subject to mailbox-provider caps. $5/year plus $0.10 per 1,000 emails; 100 a day free to test.
Try it freeRelated errors
Questions about timeout
Run nc -vz smtp.example.com 25 (or telnet). "Connection timed out" on 25 while 587 connects means the provider blocks 25 outbound.
Sometimes (Hetzner after the first invoice, Linode/Vultr by ticket). DigitalOcean and Azure rarely do. A relay on 587 is the reliable answer.
Related Guides
Continue learning with these related articles