How can I figure out if port 25 is blocked on my network?

telnet mydomain.tld 25 tells me "connection refused"

that's the extent of my network hax0r skillz.

how can i tell if it's my network i'm on or the server itself?

From serverfault John

• telnet port 25 to any other server?

  John : yep, i thought of that :) but didn't know any smtp servers off the top of my head… i theoretically could have found one easily enough but i was interested in a more general solution for future reference anyway (as was provided in the response i marked as the answer).
  From Sergey

• Does it show up in netstat as listening on that server? Can you telnet from that server to itself on port 25? If so, the server is listening on port 25.

  Then try from another machine in the same network. If that doesn't work, then a firewall is most likely to blame, and it's on the SMTP server. I'm assuming it's iptables or the Windows firewall. Check here for disabling it on Windows, or use the GUI.

  If you can't reach it from outside your network, it may either be a firewall issue (again) or a NAT issue. If you have a private address on your server (like 192.168.x.x, 172.16-32.x.x, or 10.x.x.x), then you'll need to forward port 25 from your gateway to the server's internal IP.

  This should give you a good start. Let us know!

  From Jeff McJunkin

• The tool you're looking for is "tcptraceroute". Specify the destination port, and look for at what point in the trace it fails.

  camh : If you dont have tcptraceroute, on a modern traceroute, tcptraceroute is equivalent to `traceroute -T`

  BMDan : Slick! You can even specify a port with "-p", so it'd be "tcptraceroute -Tp 25 mydomain.tld" in this case. Thanks for the pointer.
  From BMDan

• Take DNS out of the equation for a minute. Can you telnet to port 25 of the ip address of your email server?

  From joeqwerty

• use nmap to check if the host port is open. If it is, you 'd better change it to ssh :> Unfortunately telnet is dead and should be used only for backwards compatibility (Sends everything plaintext)

  But in your case, depending on what nmap returns, either the port isn't open or it's open but access is restricted only to certain group and not to anyone.

  Bill Weiss : He's using telnet to port 25, not to the telnet login port.

  Nikolaidis Fotis : ok ... my mistake ... but it's still the same. telnet to 25 usually means fake mail. And usually it's blocked. and yes .. you can still use nmap to find out if the port is open ... and yes if it's open you are blocked.

  John : Bill is right, but Nikolaidis I didn't realize nmap reports if something is filtering in between, that's great! although i've always been confused about what filtered vs. closed means, because shouldn't it list 1000+ ports as being closed?

  Jason : Becareful with nmap from residential ISP's, I've had at least one case where they shut me down due to a suspected virus or something. I had to convince them my linux machines were fine, and I couldn't run Norton AV or any AV they suggested on them, but I was Certain I was clean.

  BMDan : John: "filtered" means that no response was received from the server. "Closed" means a TCP RST was received. The former usually indicates that a firewall has blocked the connection (as they rarely issue RSTs for their "deny" rules), while the latter typically indicates that there really is nothing listening on that port, albeit with the caveat that, with a bit of effort, a crafty net.admin can completely mess up that set of assumptions.

  Nikolaidis Fotis : An explanation for the negative vote ? (Except for the part with telnet). Can't you use nmap to check if a port is open ?
  From Nikolaidis Fotis

• Hi.

  Probably the simplest way to check is go to a computer outside the network and telnet/nmap to the port.

  http://www.canyouseeme.org/ offers you to select your port number and they test it from online.

  Good luck!

  John : nice tool. but that tests incoming filtering, not outgoing.
  From Crito