Azure VM: Request to unblock outbound SMTP Port 25 (using SMTPSVC service)

Question

Azure VM: Request to unblock outbound SMTP Port 25 (using SMTPSVC service)

GG 0

Hello Microsoft Q&A Support Team,

We are operating a Microsoft SMTP Service (SMTPSVC) on an Azure VM.

We require the ability to send outbound email traffic over port 25 to external mail servers.

The SMTP service in use is the native Microsoft SMTPSVC service included with Windows Server.

The email traffic will be legitimate and compliant with anti-spam best practices.

We kindly request assistance or guidance on enabling outbound SMTP traffic on port 25 for this VM.

Thank you for your support.

Nikhil Duserla 7,045 Points de réputation Personnel externe Microsoft Moderator

2025-04-28T16:22:37.2233333+00:00

Hi GG,

Firstly, let me know which subscription you are using.

For VMs and Azure Firewall that are deployed in standard Enterprise Agreement or Microsoft Customer Agreement for enterprise (MCA-E) subscriptions, the outbound SMTP connections on TCP port 25 aren't blocked. However, there's no guarantee that external domains accept the incoming emails from the VMs and Azure Firewall. For emails rejected or filtered by the external domains, contact the email service providers of the external domains to resolve the problems. These problems aren't covered by Azure support.

For Enterprise Dev/Test subscriptions, port 25 is blocked by default. It's possible to have this block removed. To request to have the block removed, go to the Cannot send email (SMTP-Port 25) section of the Diagnose and Solve section in the Azure Virtual Network resource in the Azure portal and run the diagnostic. This process exempts the qualified enterprise dev/test subscriptions automatically.

Please refer this link for more detailed information- https://learn.microsoft.com/en-us/azure/virtual-network/troubleshoot-outbound-smtp-connectivity#enterprise-and-mca-e

Please follow below steps as shown in screenshots.

Let me know if you have any further issues. I am happy to assist you back.
GG 0 Points de réputation

2025-04-28T17:03:03.89+00:00

that is the result
Nikhil Duserla 7,045 Points de réputation Personnel externe Microsoft Moderator

2025-04-29T12:30:39.73+00:00

Hi GG,

Thank you for your response. Please check with your ISP has a policy of blocking outbound port 25 connections, except to their official outgoing SMTP servers and try with different network. also try-

Navigate to control panel>>system and security>>Windows defender firewall>>Advanced settings>> Inbound rules>>add new rule>> select port>>Enter a custom rule name, e.g. TCP "Port 25">>allow the connection>>(Domain+Private+Public).

Check whether SMTP port 25 is opened or not

Open up a command prompt.

Type “telnet <server_ip> 25” then hit enter.

Once you are determined the results. Type quit and hit enter.

Also, we recommend you use authenticated SMTP relay services to send email from Azure VMs. Connections to authenticated SMTP relay services are typically on TCP port 587 which isn't blocked.

If you have any further queries, do let us know.

3 réponses

Votre réponse

Nikhil Duserla 7,045 Points de réputation Personnel externe Microsoft Moderator

2025-04-28T16:22:37.2233333+00:00

Hi GG,

Firstly, let me know which subscription you are using.

For VMs and Azure Firewall that are deployed in standard Enterprise Agreement or Microsoft Customer Agreement for enterprise (MCA-E) subscriptions, the outbound SMTP connections on TCP port 25 aren't blocked. However, there's no guarantee that external domains accept the incoming emails from the VMs and Azure Firewall. For emails rejected or filtered by the external domains, contact the email service providers of the external domains to resolve the problems. These problems aren't covered by Azure support.

For Enterprise Dev/Test subscriptions, port 25 is blocked by default. It's possible to have this block removed. To request to have the block removed, go to the Cannot send email (SMTP-Port 25) section of the Diagnose and Solve section in the Azure Virtual Network resource in the Azure portal and run the diagnostic. This process exempts the qualified enterprise dev/test subscriptions automatically.

Please refer this link for more detailed information- https://learn.microsoft.com/en-us/azure/virtual-network/troubleshoot-outbound-smtp-connectivity#enterprise-and-mca-e

Please follow below steps as shown in screenshots.

Let me know if you have any further issues. I am happy to assist you back.
GG 0 Points de réputation

2025-04-28T17:03:03.89+00:00

that is the result
Nikhil Duserla 7,045 Points de réputation Personnel externe Microsoft Moderator

2025-04-29T12:30:39.73+00:00

Hi GG,

Thank you for your response. Please check with your ISP has a policy of blocking outbound port 25 connections, except to their official outgoing SMTP servers and try with different network. also try-

Navigate to control panel>>system and security>>Windows defender firewall>>Advanced settings>> Inbound rules>>add new rule>> select port>>Enter a custom rule name, e.g. TCP "Port 25">>allow the connection>>(Domain+Private+Public).

Check whether SMTP port 25 is opened or not

Open up a command prompt.

Type “telnet <server_ip> 25” then hit enter.

Once you are determined the results. Type quit and hit enter.

Also, we recommend you use authenticated SMTP relay services to send email from Azure VMs. Connections to authenticated SMTP relay services are typically on TCP port 587 which isn't blocked.

If you have any further queries, do let us know.

Answer 1

GG 0

Hello,

I am using a Pay-As-You-Go (Usage based) subscription under the Microsoft Azure Plan.

Thank you for your assistance.

Best regards,

Answer 2

GG 0

{1B068A55-1DFD-4523-903C-A3C8947AEFA4}

Image de l’utilisateur

We have opened the SMTP port in the firewall settings. When initiating communication, everything appears to work correctly, but there is no outbound traffic over port 25.

Answer 3

GG 0

We have opened the SMTP port in the firewall settings. When initiating SMTP communication, the session seems to start correctly on the local side, but no outbound traffic is actually established over port 25.

We also ran a connectivity test from the VM:
Test-NetConnection smtp.gmail.com -Port 25

The result shows that although the host is reachable (PingSucceeded = True), the TCP connection to port 25 fails (TcpTestSucceeded = False). Please find the attached screenshot of the test result for reference.

Could you confirm if outbound SMTP on port 25 is blocked for our subscription or this specific VM?

Nikhil Duserla 7,045 Points de réputation Personnel externe Microsoft Moderator

2025-05-02T18:38:32.5033333+00:00

Hi GG,

Thank you for sharing the information.

Outbound SMTP on port 25 is generally blocked by default for most Azure subscription types, including standard subscriptions. However, if you have an Enterprise Agreement subscription, port 25 may not be blocked.

Did you checked with your ISP has a policy of blocking outbound port 25 connections and tried with different network. Contact your ISP about allowing outbound connections to our servers on ports: 25.

also, try authenticated SMTP relay services are typically on TCP port 587, 465, 587 and 2525 which isn't blocked.

If you have any further queries, do let us know.
Mounika Reddy Anumandla 5,225 Points de réputation Personnel externe Microsoft Moderator

2025-05-05T10:23:38.9433333+00:00

Hi GG,

Just checking in to see if you had a chance to review the response provided by to your question.

Let me know if you have any further queries!
GG 0 Points de réputation

2025-05-05T10:30:37.3033333+00:00

Hi Nikhil,

Our VM is running in Microsoft Azure, therefore our service provider is Azur
Mounika Reddy Anumandla 5,225 Points de réputation Personnel externe Microsoft Moderator

2025-05-05T12:25:28.4766667+00:00
Hi GG,

In Azure, outbound SMTP on port 25 is blocked by default for most subscription types, including Pay-As-You-Go under the Microsoft Azure Plan. This restriction is in place to prevent abuse (like sending spam) and protect Azure’s IP reputation.

Azure is actively blocking outbound traffic on TCP port 25, regardless of your NSG or VM firewall settings — this block is enforced at the Azure fabric level, not something you can override in a Pay-As-You-Go subscription.

That’s why:

PingSucceeded = True (ICMP allowed)

TcpTestSucceeded = False (TCP on port 25 blocked at the platform level)

Even if you open port 25 in your VM’s firewall or Network Security Group (NSG), Azure silently drops outbound port 25 traffic unless your subscription is eligible and has explicitly requested a port 25 unblock (not available on Pay-As-You-Go).

Alternate workarounds: Use authenticated SMTP over alternate ports:

Option 1: Use Microsoft 365 (Exchange Online)

SMTP server: smtp.office365.com

Port: 587

Encryption: STARTTLS

Requires authentication with a valid Microsoft 365 account

Option 2: Use a third-party SMTP relay like SendGrid

Azure officially partners with SendGrid

Offers free and paid tiers

Uses port 587 or 465 with authentication

Option 3: Set up a relay VM outside Azure

Host an SMTP relay (e.g., Postfix or Exim) on a VPS or dedicated host with port 25 open

Configure Azure VMs to relay mail through that external server using port 587 or 465.

Hope it helps!

Let me know if you have any further queries!

If the comment is helpful, please click "upvote" to let us know!
GG 0 Points de réputation

2025-05-05T12:51:35.94+00:00

Hi Mounika,

Thank you for the detailed explanation.

We understand that outbound SMTP over port 25 is blocked at the Azure fabric level and cannot be enabled on Pay-As-You-Go subscriptions.

We currently send over 20,000 emails per day, so using the free tier of SendGrid (which is limited to 100 emails/day or 10,000/month) will not meet our production needs.

Could you please advise on the possibility of increasing the sending limits for SendGrid within Azure or suggest another reliable and scalable solution for sending high-volume transactional or system-generated emails from our Azure VM?

We’re open to using authenticated SMTP relays over port 587 or 465 as suggested, but we would appreciate guidance on the best approach given our volume requirements.

Looking forward to your advice.

Best regards, GG
Mounika Reddy Anumandla 5,225 Points de réputation Personnel externe Microsoft Moderator

2025-05-05T14:08:55.8166667+00:00
Hi GG,

I understand given your need to send over 20,000 emails per day, the SendGrid free tier will definitely not suffice.
There are several cloud email services available to use. Some of the prominent names are SendGrid, MailJet, and MailGun(Highly reliable, scalable, and widely used for transactional emails and has a Foundation plan (~$35/month) supporting 50,000+ emails/month). Whichever email service you choose, using them to send emails from Azure is similar, server address and port for SMTP and API endpoint address for REST.

Sendgrid is probably the most popular email service option for sending emails from Azure. https://www.twilio.com/docs/sendgrid/for-developers/partners/microsoft-azure-2021

You can upgrade to a Paid SendGrid Plan (Recommended for Azure-native workflows)

SendGrid offers Essentials, Pro, and Premier plans.

The Essentials plan starts at ~$14.95/month for up to 50,000 emails/month.

You can scale to millions of emails/month by moving to the Pro or Premier tiers.

These tiers also include:

Dedicated IPs (for better deliverability)

High throughput

API and SMTP relay support over port 587.

Use Azure Communication Services (ACS) Email lhttps://learn.microsoft.com/en-us/azure/communication-services/overview

This is Microsoft's native email service — scalable, reliable, and port 25–safe.

Benefits:

Uses SMTP or REST API

Microsoft-managed infrastructure (excellent deliverability)

Can be integrated with Azure Functions, Logic Apps, VMs, etc.

Offers custom domain + DKIM/SPF support
You can send a limited number of email messages. If you exceed the email rate limits for your subscription, your requests are rejected. You can attempt these requests again, after the Retry-After time passes. Take action before reaching the limit by requesting to raise your sending volume limits if needed. https://learn.microsoft.com/en-us/azure/communication-services/concepts/service-limits#email

Hope it helps!

Let me know if you have any further quereis!
Mounika Reddy Anumandla 5,225 Points de réputation Personnel externe Microsoft Moderator

2025-05-06T08:46:03.0966667+00:00

Hi GG,

Just checking in to see if you had a chance to review the response provided to your question.

If you have any further queries, please let me know.

If the information is helpful, please click "Accept Answer" and "Upvote it."

Partager via

Azure VM: Request to unblock outbound SMTP Port 25 (using SMTPSVC service)

3 réponses

Votre réponse