# SMTP connection timed out (ETIMEDOUT): blocked port fix

> SMTP “connect ETIMEDOUT” or “Greeting never received” on port 587, 465 or 25? Test the port, see which hosts block SMTP, and send over HTTPS instead.

Source: https://formsmtp.com/guides/smtp-port-blocked-connection-timeout · Last updated November 2, 2026

## What it looks like

```text
Error: connect ETIMEDOUT 142.250.102.108:587        (Node.js)
Error: Connection timeout   code: 'ETIMEDOUT'        (Nodemailer)
Error: Greeting never received                       (Nodemailer)
TimeoutError: [Errno 110] Connection timed out       (Python)
SMTP Error: Could not connect to SMTP host.          (PHPMailer)
SMTP connect() failed.                               (PHPMailer)
```

A **timeout** means nothing answered: a firewall dropped the packets without a word. That’s different from **connection refused** (`ECONNREFUSED`), where something answered “no”, which usually means a wrong host or port. And it’s different from `535`, which means you reached the server and the login failed (see the [Gmail](https://formsmtp.com/guides/gmail-smtp-username-password-not-accepted) and [Microsoft 365](https://formsmtp.com/guides/microsoft-365-smtp-auth-disabled) fixes).

## The usual causes

- **Your host blocks outbound SMTP.** Many platforms block port 25, and some block 465 and 587 too, especially on free plans. See the table below.
- **SSL setting doesn’t match the port.** “Greeting never received” after a long wait usually means the client is waiting for the server’s greeting while the server waits for a TLS handshake. That happens on port 465 with SSL off. Use SSL on for 465 and off (STARTTLS) for 587.
- **A network in between.** Office, school and some home networks block SMTP ports. Microsoft’s own setup guide warns that some firewalls and ISPs block port 25.
- **The provider blocks your server’s IP.** Rare, but Railway’s docs tell you to check with your email provider if one specific host is unreachable.

## Which hosts block SMTP

Each row is from the host’s own documentation, checked November 2, 2026. Hosts we couldn’t confirm from official pages aren’t listed.

| Host | What’s blocked | Applies to | Way out |
| --- | --- | --- | --- |
| Railway | All SMTP: “SMTP is only available on the Pro plan and above” | Free, Trial and Hobby plans | Upgrade to Pro and redeploy, or use an HTTPS email API |
| Render | Ports 25, 465 and 587 | Free web services (since late September 2025). Port 25 is blocked for all services. | Any paid instance type, or an HTTPS API |
| DigitalOcean | Ports 25, 465 and 587, including through a Reserved IP | Droplets, by default | DigitalOcean recommends a third-party email service |
| Google Cloud | Port 25 to destinations outside your VPC | Compute Engine (Google notes some projects don’t have the restriction) | Ports 465 and 587 aren’t restricted |
| AWS | Port 25 to public IPv4 and IPv6 addresses | EC2, by default | Use 465 or 587, or request removal of the restriction |
| Microsoft Azure | Port 25 | VMs, except Enterprise Agreement and MCA-E subscriptions | Authenticated SMTP on 587, which Azure doesn’t restrict |
| Vercel | Port 25 | Vercel Functions | Ports 465 and 587 are open |

Two patterns stand out. Port 25 is blocked almost everywhere, and it’s the wrong port for an app anyway: it’s for server-to-server relay. Use 587 or 465 to submit mail (RFC 8314 recommends implicit TLS on 465). On the platforms that block all three ports, no port change helps. You need a paid plan or HTTPS.

## Test the port from the server

Run these from the machine that sends the email: the container, Droplet or VM, over SSH or the platform’s shell. Testing from your laptop only proves your laptop can connect.

```bash
# macOS / Linux: can we open a TCP connection at all?
nc -vz -w 5 smtp.gmail.com 587
nc -vz -w 5 smtp.gmail.com 465

# Talk to the server (type QUIT to leave). A "220 ..." greeting means the port is open.
openssl s_client -starttls smtp -crlf -connect smtp.gmail.com:587   # STARTTLS port
openssl s_client -crlf -connect smtp.gmail.com:465                  # implicit TLS port

# No nc or openssl in the container? Bash can do it alone:
timeout 5 bash -c "</dev/tcp/smtp.gmail.com/587" && echo open || echo blocked
```

```powershell
# Windows PowerShell
Test-NetConnection smtp.office365.com -Port 587
# TcpTestSucceeded : True   -> reachable
# TcpTestSucceeded : False  -> blocked or wrong host
```

- **You see a `220 …` greeting:** the port is open. Look at TLS settings and the login instead.
- **It hangs, then times out:** the port is blocked between you and the server.
- **“Connection refused”:** the host is reachable but nothing listens on that port. Check the host name and port.
- **587 works but 465 doesn’t, or the reverse:** use the one that works, with the matching SSL setting.

## Fixes, in order

1. **Try the other submission port.** Switch between 587 (STARTTLS) and 465 (SSL). Some sending services also accept 2525, which is worth trying when 587 is blocked. See the [SMTP settings page](https://formsmtp.com/smtp-settings) for which providers offer it.
2. **Change the plan.** On Railway and Render, the block is tied to the free or Hobby tier. On AWS, you can ask for the port 25 restriction to be removed, though 587 is the better choice.
3. **Send over HTTPS instead.** Port 443 is open everywhere outbound web traffic is. Most sending services (SES, Resend, Brevo, Mailgun, Postmark) have an HTTP API. Railway’s docs recommend this route on every plan.

## Keep your own mailbox, send over HTTPS

An email service’s HTTP API means sending from that service. If you want the email to keep coming from your own Gmail, Microsoft 365, Zoho or company mailbox, something outside the blocked network has to make the SMTP connection for you.

**Using FormSMTP?** That’s what FormSMTP does. It stores your SMTP login encrypted, your app makes one HTTPS request on port 443, and FormSMTP’s servers connect to your SMTP server. Nothing in your code opens an SMTP connection, so plan-level SMTP blocks don’t apply. [Create a free project](https://app.formsmtp.com/#/signup), click *Test connection*, then:

```js
// One HTTPS request on port 443. FormSMTP makes the SMTP connection to your
// own mailbox or provider from its servers, with the login you saved.
const res = await fetch("https://app.formsmtp.com/api/v1/send", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + process.env.FORMSMTP_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    to: "you@yourdomain.com",
    subject: "New signup",
    text: "Someone just signed up.",
  }),
});
console.log(await res.json()); // { success: true, messageId: "..." } or { success: false, error: "SMTP error: ..." }
```

For a website form, there’s no server code at all: see [how form SMTP works](https://formsmtp.com/form-smtp).

## Sources

Checked on the vendors’ own pages on November 2, 2026.

- [Railway Docs: Outbound networking](https://docs.railway.com/reference/outbound-networking)
- [Render Docs: Deploy for free](https://render.com/docs/free)
- [Render changelog: Free web services will no longer allow outbound traffic to SMTP ports](https://render.com/changelog/free-web-services-will-no-longer-allow-outbound-traffic-to-smtp-ports)
- [DigitalOcean Docs: Why is SMTP blocked?](https://docs.digitalocean.com/support/why-is-smtp-blocked/)
- [Google Cloud: Sending email from an instance](https://docs.cloud.google.com/compute/docs/tutorials/sending-mail)
- [AWS: Amazon EC2 service quotas (Restriction on email sent using port 25)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html#port-25-throttle)
- [Microsoft Learn: Troubleshoot outbound SMTP connectivity in Azure](https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-network/troubleshoot-outbound-smtp-connectivity)
- [Vercel Knowledge Base: Can I use SMTP with Vercel?](https://vercel.com/kb/guide/serverless-functions-and-smtp)
- [Microsoft Learn: Set up a device or application to send email using Microsoft 365](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
- [RFC 8314: Use of TLS for Email Submission and Access](https://www.rfc-editor.org/rfc/rfc8314)

## FAQ

### Why does my email work locally but time out in production?

Your laptop’s network allows outbound SMTP and your host doesn’t. Railway (Free, Trial, Hobby), Render (free web services) and DigitalOcean Droplets block ports 25, 465 and 587 by default. Run nc or Test-NetConnection from the server to confirm.

### What does “Greeting never received” mean?

The TCP connection opened but the server never sent its 220 greeting. Most often that’s SSL off on port 465, where the server is waiting for a TLS handshake first. Turn SSL on for 465, or use 587 with STARTTLS.

### Is port 25 ever right for sending from an app?

Rarely. Port 25 is for server-to-server relay, and Google Cloud, AWS, Azure, Render and Vercel all block or restrict it. Submit mail on 587 or 465.

### Will port 2525 get around the block?

Sometimes. It’s unofficial and only some sending services listen on it, but a host that only blocks 25, 465 and 587 won’t stop it. On Railway’s Hobby plan all SMTP is disabled, so use HTTPS instead.

## More guides

- [Gmail 535-5.7.8 Username and Password not accepted: fix](https://formsmtp.com/guides/gmail-smtp-username-password-not-accepted)
- [535 5.7.139 SmtpClientAuthentication is disabled: fix](https://formsmtp.com/guides/microsoft-365-smtp-auth-disabled)
- [SMTP error codes explained: 421, 535, 550, 554 and more](https://formsmtp.com/guides/smtp-error-codes)
- [Contact form emails going to spam or not arriving: fixes](https://formsmtp.com/guides/contact-form-emails-going-to-spam)