Question
Some droplet can't connect to smtp port.
- Posted on April 3, 2025
- DigitalOcean Cloud FirewallsNetworkingDroplets
Asked by Chatree Kunjai
Hello,
I encountered an issue on some Droplets where they cannot connect to other hosts using port 587 (SMTP protocol). I have checked the firewall group rules and iptables rules on the affected Droplets, but I did not find any rules blocking outgoing TCP port 587.
To debug the issue, I tested by setting up a listening TCP port 587 on another Droplet within the same network. When I tried to connect from the affected Droplet using telnet, it failed. However, when I reversed the test, the other Droplet could successfully connect back to TCP port 587 on the affected Droplet.
Additionally, I tested connecting to smtp.gmail.com on TCP port 587 and captured tcpdump traffic to compare between a working and a non-working Droplet. The results were as follows:
- Droplet that can connect to smtp.gmail.com:
tcpdump -i eth0 port 587
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
17:26:01.605785 IP dgo-ter-prd-ads-1.63174 > sa-in-f108.1e100.net.submission: Flags [S], seq 1518527726, win 42340, options [mss 1460,sackOK,TS val 2920465099 ecr 0,nop,wscale 9], length 0
17:26:01.610775 IP sa-in-f108.1e100.net.submission > dgo-ter-prd-ads-1.63174: Flags [S.], seq 716093568, ack 1518527727, win 65535, options [mss 1412,sackOK,TS val 1948154854 ecr 2920465099,nop,wscale 8], length 0
17:26:01.610823 IP dgo-ter-prd-ads-1.63174 > sa-in-f108.1e100.net.submission: Flags [.], ack 1, win 83, options [nop,nop,TS val 2920465104 ecr 1948154854], length 0
17:26:01.771273 IP sa-in-f108.1e100.net.submission > dgo-ter-prd-ads-1.63174: Flags [P.], seq 1:76, ack 1, win 1050, options [nop,nop,TS val 1948155015 ecr 2920465104], length 75
17:26:01.771344 IP dgo-ter-prd-ads-1.63174 > sa-in-f108.1e100.net.submission: Flags [.], ack 76, win 83, options [nop,nop,TS val 2920465265 ecr 1948155015], length 0
17:26:10.994375 IP dgo-ter-prd-ads-1.63174 > sa-in-f108.1e100.net.submission: Flags [P.], seq 1:3, ack 76, win 83, options [nop,nop,TS val 2920474488 ecr 1948155015], length 2
17:26:10.995834 IP sa-in-f108.1e100.net.submission > dgo-ter-prd-ads-1.63174: Flags [.], ack 3, win 1050, options [nop,nop,TS val 1948164240 ecr 2920474488], length 0
17:26:11.208083 IP dgo-ter-prd-ads-1.63174 > sa-in-f108.1e100.net.submission: Flags [P.], seq 3:5, ack 76, win 83, options [nop,nop,TS val 2920474702 ecr 1948164240], length 2
- Droplet that cannot connect to smtp.gmail.com:
tcpdump -i eth0 port 587
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
17:17:08.636918 IP dgo-ter-prd-red-1.9018 > sh-in-f108.1e100.net.submission: Flags [S], seq 1406560675, win 42340, options [mss 1460,sackOK,TS val 1272778776 ecr 0,nop,wscale 9], length 0
17:17:09.644587 IP dgo-ter-prd-red-1.9018 > sh-in-f108.1e100.net.submission: Flags [S], seq 1406560675, win 42340, options [mss 1460,sackOK,TS val 1272779784 ecr 0,nop,wscale 9], length 0
17:17:11.660629 IP dgo-ter-prd-red-1.9018 > sh-in-f108.1e100.net.submission: Flags [S], seq 1406560675, win 42340, options [mss 1460,sackOK,TS val 1272781800 ecr 0,nop,wscale 9], length 0
Could you help me investigate what might be causing this issue?
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.
Hi there,
I believe that the SMTP ports (25, 465, and 587) are blocked on all Droplets for new accounts to prevent spam and other abuses:
Even if SMTP were available, DigitalOcean strongly recommends against running your own mail server in favor of using a dedicated email deliverability platform. Dedicated email deliverability platforms are better at handling deliverability factors like IP reputation.
To send mail from DigitalOcean, they recommend using SendGrid.
Alternatively you could reach out to the DigitalOcean support team and check if they could lift the block for you but in many cases this is not possible:
- Bobby.
Heya, @chatreekun
The SMTP ports and SMTP in general are disabled for all new accounts. You can probably try using authentication and sending emails via API or use an external provider like SendGrid to send your emails.
Regards