Sending email from Hetzner Cloud: port 25 is closed until your first invoice, relay on 587
Hetzner Cloud blocks outbound ports 25 and 465 for new accounts (usually until the first paid invoice, on request) and its mail hostname mail.your-server.de is for Hetzner webhosting mailboxes only. How to relay from a Hetzner server, plus webhosting SMTP settings.
Hetzner outgoing mail server: Cloud servers: relay through smtp.queensmtp.com on 587 — Hetzner Webhosting mailboxes: mail.your-server.de.
Hetzner SMTP settings at a glance
| Outgoing (SMTP) host | Cloud servers: relay through smtp.queensmtp.com on 587 — Hetzner Webhosting mailboxes: mail.your-server.de |
|---|---|
| Ports & encryption |
587 — STARTTLS <em>(open on Cloud)</em>465 — SSL/TLS <em>(blocked on new Cloud accounts, open after unlock)</em>25 — — <em>(blocked on new Cloud accounts; unlock request in the Cloud Console)</em> |
| Username | relay: your SMTP username — webhosting: the full mailbox address |
| Password | relay: your SMTP password — webhosting: the mailbox password |
| Authentication | Hetzner Cloud: "Outgoing mail traffic is blocked by default" for new projects; a request in the Cloud Console (after the first invoice) unlocks 25/465. Dedicated servers are not blocked but are unblocked after verification. |
How to set up Hetzner SMTP
- Cloud server: relay via smtp.queensmtp.com:587 (STARTTLS) from the app or Postfix relayhost.
- To run your own MTA: set rDNS in the Cloud Console → Networking, then request the mail-port unlock.
- Webhosting mailbox in a client: host mail.your-server.de, port 587 STARTTLS or 465 SSL, full address and password.
Sending limits
- Webhosting mailboxes have per-hour limits; Cloud has none once unlocked.
Things that catch people out
- Hetzner IP space is blocklisted on UCEPROTECT Level 3 at times — a relay avoids inheriting that.
Common Hetzner SMTP errors
| Server reply | Meaning | Fix |
|---|---|---|
Connection timed out (25/465) | New-account block. | Relay on 587 or request unlock. |
More codes: 535 authentication failed, 550 relay denied, 554 rejected as spam, connection timed out — or all SMTP error codes.
When Hetzner is not enough for your app
When a provider caps you or blocks a port, point the same app at QueenSMTP instead: host smtp.queensmtp.com, port 587 (STARTTLS) or 465 (SSL), your SMTP username and password from the dashboard. $5/year plus $0.10 per 1,000 emails, 100 free a day to test.
Get SMTP credentials — free to test Test your relay nowRelated settings
Hetzner SMTP — questions
New Hetzner Cloud accounts have outbound 25 and 465 blocked. Relay through an SMTP provider on 587, or request the unlock in the Cloud Console once you have an invoice.
Related Guides
Continue learning with these related articles