I've got a mail server set up using postfix, dovecot, opendkim, and spamassassin. After a bit of hassle, I managed to get incoming mail working--I even set this account up using that server.

However, I've got a problem with outgoing mail. My ISP, fat as it is, blocks communications through port 25... meaning that, obviously, sending messages doesn't work. Here's logs after attempting to send to my old Protonmail account (from Neomutt on an external machine):

postfix/qmgr[653083]: 7E2BD9006AB: from=<[email protected]>, size=479, nrcpt=1 (queue active)
// disconnect from external client
postfix/smtp[653086]: connect to mail.protonmail.ch[]:25: Connection timed out
postfix/smtp[653093]: connect to mail.protonmail.ch[]:25: Connection timed out
postfix/smtp[653086]: connect to mailsec.protonmail.ch[]:25: Connection timed out
postfix/smtp[653086]: 44DED90068A: to=<[email protected]>, relay=none, delay=115, delays=55/0.05/60/0, dsn=4.4.1, status=deferred (connect to mailsec.protonmail.ch[]:25: Connection timed out)

So, yeah... ISP blocks port 25 (outgoing), so I need a way to bypass this. One way I saw a lot about was configuring to use an external smtpd. I'd either have to use my ISP's (not ideal) or, set up postfix on my friend's VPS (not exactly ideal either but if all else fails I'll ask him). TECHNICALLY I could ask my ISP to unblock port 25, but that, well, might not work.

However, I'd instead like to route all outgoing mail to port 465 or 587 of external servers, not 25, using only my local postfix setup. I couldn't find anything about this online, and changing the outgoing smtp port to an alternate port in master.cf still sends stuff through 25. So, how should I go about doing this? Keep in mind, if there's literally nothing I can do then I can just ask my friend for his VPS

postconf -n:

alias_database = $alias_maps
alias_maps = hash:/etc/postfix/aliases
command_directory = /usr/bin
compatibility_level = 3.6
daemon_directory = /usr/lib/postfix/bin
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
home_mailbox = Mail/Inbox/
html_directory = no
inet_protocols = ipv4
mail_owner = postfix
mailbox_command = /usr/lib/dovecot/deliver
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
meta_directory = /etc/postfix
milter_default_action = accept
milter_protocol = 6
mydestination = $myhostname $mydomain localhost localhost.localdomain
mydomain = doma.in
myhostname = mail.doma.in
mynetworks = [::1]/128 MY.IP/32
newaliases_path = /usr/bin/newaliases
non_smtpd_milters = inet:
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix
relay_domains = $mydestination
sample_directory = /etc/postfix
sendmail_path = /usr/bin/sendmail
setgid_group = postdrop
shlib_directory = /usr/lib/postfix
smtp_tls_CAfile = /etc/letsencrypt/live/doma.in/cert.pem
smtp_tls_loglevel = 1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_security_level = may
smtpd_milters = inet:
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/doma.in/fullchain.pem
smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, eNULL
smtpd_tls_key_file = /etc/letsencrypt/live/doma.in/privkey.pem
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_security_level = may
tls_preempt_cipherlist = yes
unknown_local_recipient_rject_code = 550
  • Ask your ISP to unblock the port first. ISP's really should not be blocking anything from you.
    – Bib
    Jul 25, 2021 at 15:49
  • @Bib This could be regulated. Local or national communications authorities may have mandated ISPs to block port 25, as a spam prevention measure. Jul 25, 2021 at 17:32
  • Realy? Where? Certainly not in the UK.
    – Bib
    Jul 25, 2021 at 17:50
  • @Bib yeah well im not british
    – swurl
    Jul 29, 2021 at 0:21

3 Answers 3


You can use port 587 with:

postconf -ev relayhost=smtp.example.com:submission

When using port 587, the relay host might well require authentication, in which case you would specify the required username and password in file/etc/postfix/sasl_passwd.

If the DNS name of the chosen relay host is not its primary name (i.e. dig -x <ip-address-of-relay-host> returns some other name for the relay host), then you could override the canonical name check by putting the name of the relay host in brackets, and adding quotes to protect the brackets from the shell:

postconf -ev "relayhost=[smtp.example.com]:submission"
  • WHile this is a solution, it requires the use of an external smtp server. I was asking the question as doing it locally; sending via port 587 to some SMTP server should work the samew ay as regular port 25 SMTP.
    – swurl
    Aug 5, 2021 at 1:48
  • @swurl Did you find a solution to this?
    – Myzel394
    Jan 22, 2023 at 20:29
  • Sometimes port 587 may accept unauthenticated incoming email to the target domain like regular port 25, but at other servers, the use of port 587 will always require authentication. Furthermore, since the port 587 is intended to be used by each organization's own users/customers only, there is no universal way to figure out the hostname of a particular domain's mail submission server from the internet. It might be the same as the mail server indicated by the public DNS MX records, or it might not be.
    – telcoM
    Jan 22, 2023 at 22:02
  • @Myzel394 I did not. I ended up switching to a VPS, as outlined in my answer. You can get a simple one for a mail server pretty cheap.
    – swurl
    May 1, 2023 at 20:59

I asked my ISP to unblock port 25, and unfortunately, corporate higher-ups don't let users use that port at all, so it can't be unblocked.

So because of that, I just sucked it up and bought a VPS, and it worked perfectly. Turns out to be useful for quite a lot of things besides mail though, such as a VPN, a fast CPU for more demanding server tasks (such as a Matrix homeserver), etc.

Unfortunately I never managed to find out how to make postfix behave like this. If someone does know how, then by all means please answer.

For anyone whose ISP blocks port 25, please consider investing into a VPS or switching ISPs.


Edit file /etc/services changing port 25 to 587, save and restart service postfix. Postfix will stop listening on port 25 and switch to 587, I don't know if that would be a problem but it is a solution.

  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Feb 19, 2023 at 0:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .