I need to enable SMTP port 25 outgoing messages from my VMs

Hi Jesús San Miguel

The backend team has confirmed that, starting November 15th, 2017, sending outbound email directly to external domains (such as outlook.com, gmail.com) from a Virtual machine (VM) was made available only to certain subscription types.

In March 2022, the policy was further changed so that we will no longer allow exceptions to the block on outbound port 25 (SMTP) for Pay as you go or CSP subscription types. Existing customers and subscriptions with existing exceptions will continue to be allowed so we will not break existing customers. However, no new exemptions will be granted for these subscription types.

Even if you have a subscription with an existing exemption and need a new subscription exempted, this cannot be done due to our policy outlined publicly. You can continue to deploy new resources in your existing subscription that has already been exempted, if available.

The only subscription type that can be exempted is Enterprise Agreement MSDN.

Hope you find this comment helpful ,if yes, please “up-vote” for the information provided , this can be beneficial to community members.

Thanks

It is a benefit of our AI Cloud Partner Program (MS-AZR-0036P)

Hi Jesús San Miguel,

Welcome to Microsoft Q&A forum

We understand you're looking to have SMTP port 25 opened for your virtual machine in the Azure environment. Please note that Azure blocks outbound SMTP connections on TCP port 25 by default for most subscriptions, including Enterprise Dev/Test, as a security precaution.

If you require access to SMTP port 25, you'll need an enterprise subscription. This port is not blocked for Enterprise Agreement (EA) or Microsoft Customer Agreement for Enterprise (MCA-E) subscriptions, though external domains may still be filtered.

• Go to the Virtual Network resource linked to your VM
• Open the "Diagnose and Solve Problems" section.
• Select “Cannot send email (SMTP-Port 25)”.
• Once the block is removed, you'll need to stop and restart your virtual machine to apply the new network policy, all VMs in that subscription are exempted going forward.

If the virtual network owned by the exempted subscription has a delegated subnet (to an App Service Environment for example), you must add and remove a new temporary subnet in the Virtual Network. The exemption applies only to the subscription requested and only to VM traffic that is routed directly to the internet.

We recommend you use authenticated SMTP relay services to send email from Azure VMs or from Azure App Service. Connections to authenticated SMTP relay services are typically on TCP port 587 and isn't blocked. These services are used in part to maintain IP reputation that is critical for delivery reliability.

Reference link for better understanding: https://learn.microsoft.com/en-us/azure/virtual-network/troubleshoot-outbound-smtp-connectivity

Hope you find this comment helpful ,if yes, please “up-vote” for the information provided , this can be beneficial to community members.

Kindly let us know if you have any additional questions.

Thanks