What is port 25?

The block exists for good reason. An infected home machine sending spam directly was once a large share of the world's junk mail, and closing the port at the ISP ended that class of abuse.

AWS restricts outbound 25 on EC2 and requires a request with justification to lift it. Google Cloud blocks it outright with no exception process. Azure blocks it for most subscription types.

That constraint shapes the industry quietly. Verification providers need infrastructure where the port is open and the addresses have standing, which is a real recurring cost that the marketing copy never mentions.

Reputation on those addresses matters as much as access. A provider that throttles or refuses your connecting IP turns answerable addresses into unresolved ones, so the quality of the pool is part of the quality of the product.

You can find out whether your network lets you reach port 25 before you write a line of code. Open a terminal and run nc -vz -w 10 gmail-smtp-in.l.google.com 25. That asks for a plain TCP connection to one of Gmail's inbound mail hosts and gives up after ten seconds.

On a home connection or a fresh cloud instance, you'll most likely watch it hang and time out. Blocks of this kind usually drop the packets silently, so you see a timeout instead of a refusal. Where the port is open, the connection succeeds, and a telnet session to the same host shows a greeting line that starts with 220.

Say you try it from three places: your office, a laptop on home broadband, and a new virtual server. It's common for all three to fail, and that result tells you more about where you're standing than about Gmail.

Getting a 220 greeting is only the first hurdle. Receiving servers look at who's connecting before they answer honestly. They check whether your IP has a reverse DNS record, whether the name you give in EHLO resolves back to that IP, and whether the address sits on a blocklist.

Spamhaus keeps a Policy Blocklist of ranges that shouldn't be sending direct mail at all, such as consumer broadband. An IP in that list gets refused by many servers no matter how politely it speaks SMTP.

So when you compare verifiers, ask where their probes come from. Do the addresses have matching forward and reverse DNS? How old are they? What happens to your results when a big provider starts throttling that pool? A vendor who can't answer is probably renting whatever was cheapest, and that shows up in your file as a larger share of unknown.