An Azure network security service that is used to protect Azure Virtual Network resources.
Hi @Balasubramanian Rajendran,
Thank you for reaching out on Microsoft Q&A forum.
Azure applies platform‑level restrictions on outbound SMTP over TCP port 25 for most subscription types to prevent spam. This block is enforced outside the VM, so NSGs, UDRs, OS firewall rules, or cPanel settings cannot override it. As a result, inbound email can work while outbound delivery fails or times out.
Microsoft documentation:
- Troubleshoot outbound SMTP connectivity in Azure (official)
https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-network/troubleshoot-outbound-smtp-connectivity
Subscription behavior (important)
- Enterprise Agreement (EA) / MCA‑E (standard): Outbound SMTP on port 25 is not blocked by Azure, but delivery to external domains is not guaranteed (remote providers may still reject based on IP reputation).
- Enterprise Dev/Test: Port 25 is blocked by default; you can request removal via Virtual Network → Diagnose and Solve → “Cannot send email (SMTP‑Port 25)”, then stop, deallocate, and start the VM for the policy to apply.
- All other subscription types (PAYG, Student, etc.): Port 25 is blocked and cannot be used.
Microsoft recommends using an authenticated SMTP relay instead of direct SMTP on port 25. Authenticated relays use TCP port 587 (or 465), which is not blocked in Azure for any subscription type, and provides better deliverability and IP reputation management.
Kindly share the details requested over Priavate message if you need further assistance on this issue!
If the answer is helpful, please "Accept the answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".