Sending email from a DigitalOcean Droplet: port 25 is blocked, use a relay on 587
DigitalOcean blocks outbound SMTP port 25 on new accounts and does not run a mail relay. How to send from a Droplet anyway: authenticated relay on port 587/465 (Postfix relayhost, app config), plus rDNS and SPF notes.
DigitalOcean outgoing mail server: none from DigitalOcean — relay through smtp.queensmtp.com (or any provider) on port 587/465.
DigitalOcean SMTP settings at a glance
| Outgoing (SMTP) host | none from DigitalOcean — relay through smtp.queensmtp.com (or any provider) on port 587/465 |
|---|---|
| Ports & encryption |
587 — STARTTLS <em>(allowed outbound)</em>465 — SSL/TLS <em>(allowed outbound)</em>25 — — <em>(blocked outbound on new accounts; unblock requests are rarely granted)</em> |
| Username | your relay SMTP username |
| Password | your relay SMTP password |
| Authentication | DigitalOcean's policy: SMTP port 25 is blocked for new accounts to stop spam; they recommend a third-party relay on 587. Even when unblocked, Droplet IP ranges have weak reputation with Gmail/Microsoft. |
How to set up DigitalOcean SMTP
- Create SMTP credentials at your relay (QueenSMTP: dashboard → SMTP Settings → Add credential) and verify your sending domain (SPF + DKIM).
- Application: host smtp.queensmtp.com, port 587, STARTTLS, username/password = relay credentials.
- Whole server (Postfix): set relayhost = [smtp.queensmtp.com]:587, smtp_sasl_auth_enable = yes, smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd, smtp_tls_security_level = encrypt, then postmap and restart.
Sending limits
- No mail service; no per-account sending quotas because there is nothing to send through.
- Reverse DNS for a Droplet is set from its hostname — set the Droplet name to the FQDN if you do run a mail server.
Things that catch people out
- Testing with telnet to port 25 will hang forever — test 587 instead.
- Cron/system mail (root@droplet) also needs the relay or it silently piles up in the local queue.
Common DigitalOcean SMTP errors
| Server reply | Meaning | Fix |
|---|---|---|
Connection timed out (port 25) | DigitalOcean firewall. | Use 587/465 to an authenticated relay. |
More codes: 535 authentication failed, 550 relay denied, 554 rejected as spam, connection timed out — or all SMTP error codes.
When DigitalOcean is not enough for your app
When a provider caps you or blocks a port, point the same app at QueenSMTP instead: host smtp.queensmtp.com, port 587 (STARTTLS) or 465 (SSL), your SMTP username and password from the dashboard. $5/year plus $0.10 per 1,000 emails, 100 free a day to test.
Get SMTP credentials — free to test Test your relay nowRelated settings
DigitalOcean SMTP — questions
Outbound port 25 is blocked on new accounts. Send through an authenticated SMTP relay on port 587 or 465 instead — from the app directly or by setting Postfix's relayhost.
No. Use a third-party relay; DigitalOcean recommends this in its own docs.
Related Guides
Continue learning with these related articles