AWS Blocking Port 25 – Alternatives for Sending Mail via KumoMTA?

Hello KumoMTA Team & Community,

We have successfully set up KumoMTA on an AWS EC2 instance and completed initial configuration (TLS, domain setup, routing, etc.).

However, we are facing a blocker:

Issue

  • AWS is not allowing outbound port 25 (SMTP) from our EC2 instance

  • We have raised multiple support requests, but the request to unblock port 25 is being denied

  • This is a new AWS account with no prior sending history

Questions / Help Needed

  1. Alternative SMTP Ports

    • Can KumoMTA be reliably configured to send emails via:

      • Port 587 (Submission)

      • Port 465 (SMTPS)

    • Are there any limitations for bulk sending when not using port 25?

  2. Using SMTP Relay

    • Is it recommended to configure KumoMTA to route outbound emails via an SMTP relay (e.g., another provider)?

    • Any best practices for:

      • Performance

      • Deliverability

      • Queue handling

  3. Workarounds within AWS

    • Has anyone successfully used KumoMTA on AWS without port 25?

    • Any known configurations (NAT, proxy, etc.) that work?

  4. Alternative Hosting Providers

    • If AWS is not suitable for this use case, what providers are recommended for:

      • Bulk email sending

      • Port 25 availability

      • Good IP reputation control

Goal

We want to run KumoMTA as a private SMTP infrastructure without relying heavily on third-party sending services, while maintaining:

  • Good deliverability

  • Scalability (high volume sending)

  • Security

Any guidance, configurations, or real-world experiences would be highly appreciated.

Thanks in advance!

Sending out the non-25 ports will do you no good. Those ports are designated for internal injection, and I doubt that a good percentage of the mailbox providers would even accept injections on those ports.

I’d say you either need to get port 25 open or look elsewhere.

Thanks!

OVHCloud and Hetzner are keeping port 25 open and good for KumoMTA.

Any specific recommendation?

Hey, I have some customers using EC2, and yes, there is a restriction, but you can ask for this restriction to be removed: Amazon EC2 service quotas - Amazon Elastic Compute Cloud

They usually react pretty quickly !

But I must warn that it’s quite rare to get the ports unblocked if you have no past billing history with AWS. We have tried it a few times and were always rejected.

Hetzner, Contabo, LeaseWeb, Vultr, Snel, Summit, Hivelocity, HostPapa, NForce, Linode, Worldstream, Datapacket, Velia, HostKey, Interserver, Latitude

All of these providers will open port 25 if you can show a genuine need for it.

I must disagree… 100% of my clients who requested it had the restrictions on port 25 removed!

Why would AWS provide a process if they refuse to lift the restriction ?

If they refuse it to someone, it could be related to the use of port 25 on AWS by the person who requested it!

We’re an ESP, own three IP ranges and have over 3,000 senders on our network. We tried to get the port 25 opened, clearly mentioned how we are an ESP, provided our business details and history, and how we handle spam complaints, bounce and suppressions.

The request was rejected every single time with the following message:

This account, or those linked to it, have been identified as having at least one of the following:
* A history of violations of the AWS Acceptable Use Policy
* A history of being not consistently in good standing with billing
* Not provided a valid/clear use case to warrant sending mail from EC2

Unfortunately, we are unable to process your request at this time, please consider looking into the Simple Email Service. https://aws.amazon.com/ses/

Never used AWS before, either personally or for business.

So we just decided to work with some hosting providers and datacenters, bring our own IP addresses. Much easier and scalable, and less headache.

So.. yep, the world isn’t so black and white.

One of my clients, a KumoMTA user, subscribed to an EC2 instance on AWS four months ago. He had never been an AWS customer before. 48h after subscribing, he requested the removal of the port 25 restriction, which was granted within two hours.

I have about 20 similar cases, some clients using AWS IP addresses, others their own IP addresses. In all cases, the port 25 restriction was lifted without any issues.

From what I know of AWS people, they don’t refuse requests without reason. It could be a very old account created years ago by a former employee, with an email address using the same domain, which creates a link to your account. And yes, you don’t have any of the problems they’re talking about, but that person did have problems with your domain linked to your company!

You’re fully right, the world is not black and white, but there’s no smoke without fire!

Regarding other hosting company, some of them have bad reputation by default, when you are using their IPs, so choosing the right one for email deliverability could be a real subject !

Interesting! Perhaps we should try again with a different domain name, but then.. we have outgrown our need for AWS now. Our domain was previously used as a “mailbox service” in the past (like @gmail.com) which could possibly explain this scenario. That said, no one’s ever used AWS directly from our business or domain. Personally too. But.. I did use AWS at university, but that was handled through AWS Educate and shouldn’t really count! :stuck_out_tongue:

We already use our own 3x /24 IP ranges and plan to acquire another one by the end of the year. In addition, we’re also looking to setup our own ASN sometime this year which would pretty much guarantee us absolute control over our IP and network reputation.