Try this: get a mail server running on your home internet connection — a real one, talking directly to Gmail and Outlook the way servers are supposed to — and watch it fail. Not because you configured something wrong. Because the port it needs is blocked before your packets leave the building. Your ISP dropped outbound port 25 years ago, and so did most consumer providers. The port that is SMTP, the one the protocol was assigned in 1982, is a dead letter on the last mile of the internet.
That blocking was the right call. I want to be clear about that up front, because the rest of this is a complaint and I don’t want it mistaken for a demand to undo the fix. Port 25 blocking is one of the most effective anti-spam measures ever deployed. But it’s worth staring directly at what it cost, because the cost was the thing email was supposed to be: a federated network where anyone could stand up a server and be a first-class participant. That internet existed. Port 25 blocking is a big part of how it ended, and almost nobody mourned it because the alternative was drowning.
The port that meant “anyone can play”
RFC 821, published in August 1982, gave SMTP a single well-known port: 25. There was no distinction between a person sending mail and a server forwarding it, because in 1982 there was no distinction worth drawing. Every host that spoke SMTP listened on 25, accepted mail, and passed it toward its destination. If you had a machine on the network and it ran an MTA, you were a peer. You could send to anyone, receive from anyone, relay for anyone. The network asked no permission and offered no gatekeeper.
This is the part that’s genuinely hard to feel now, because we grew up inside its replacement. Email was designed as a federation. No central authority, no approved-sender list, no reputation score deciding whether your mail counted. Just a mesh of independent servers agreeing to carry each other’s messages on port 25. It was the same architectural bet the early internet made everywhere: put the intelligence at the edges, keep the middle dumb, and let anyone join by simply showing up. Email was arguably the purest expression of it. A university, a company, a hobbyist with a spare box — all equals on the same port.
And then it got used exactly as openly as it was designed to be.
Spam broke the assumption the port was built on
Port 25 assumed good faith. The entire model — accept mail from strangers, forward it onward — works only if the strangers are mostly honest. By the late 1990s that assumption was rubble. Open relays were being harvested and pumped full of spam. Then something worse: instead of abusing other people’s servers, spammers started running their own senders on cheap, disposable, dynamic IP addresses — the exact same residential and dial-up ranges that ISPs handed to ordinary customers. A compromised home PC on a botnet could open a socket to any mailserver in the world on port 25 and fire spam directly at it, no relay required. “Direct-to-MX” from consumer space became the spammer’s workhorse.
The defenders’ logic followed inevitably. Almost nothing legitimate originates from a residential dynamic IP talking straight to a stranger’s port 25. Real users hand their mail to their own provider, which then does the relaying. So: block the port at the source. In December 1998, RFC 2476 had already carved out port 587 as a separate “submission” port for authenticated users, precisely so that legitimate outbound mail had somewhere to go that wasn’t 25. That gave ISPs cover to slam 25 shut for consumers without cutting off anyone’s ability to send.
By the mid-2000s it was formal policy. The group now called M3AAWG — the messaging industry’s anti-abuse coalition — published a best-practice recommendation in 2005 (refreshed in 2023) to manage or block port 25 on residential and dynamic space, leaving only authorized relays able to use it. RFC 5068 codified the same posture in 2007. And Spamhaus built the PBL, a list of IP ranges — dynamic, residential, “should never be sending mail directly” — that receiving servers could reject on sight. Three independent mechanisms, all pointing the same direction: the open port was closing, and the edge of the network was being demoted from peer to client.
What actually died
Here’s the inversion. Port 25 is still open — between servers. Two established mailservers with clean IP reputations still talk to each other on 25 exactly as they did in 1982. The port wasn’t removed. It was made conditional. And the condition is: you have to already be somebody.
To send mail that reliably reaches inboxes today, you need an IP address with a warm reputation, forward and reverse DNS that match, SPF and DKIM and DMARC all aligned, and ideally a track record measured in months. None of that is available to a person who just wants to run a mailserver from a new IP the way they’d run a web server. A fresh IP is guilty until proven innocent. You can do everything right — perfect authentication, clean configuration — and still land in spam folders for weeks because the receiving side has learned that unknown senders are, statistically, a threat. The federation still technically exists. It’s just that joining it as a new independent operator went from “plug in a server” to “spend months building reputation and hope.”
So the practical answer for anyone who needs email to work became: don’t run your own. Hand it to Google, Microsoft, or one of a handful of providers who already have the reputation, the IP warmth, the deliverability relationships. And people did, overwhelmingly. The result is an email system that is still called federated, still speaks an open protocol, still runs on port 25 under the hood — but in which a startling share of the world’s mailboxes sit behind a very small number of companies. The protocol stayed open. The market closed.
The moat nobody built on purpose
This is where the complaint sharpens. The reputation regime that replaced the open port isn’t a conspiracy — it’s an emergent moat, and it protects incumbents beautifully whether or not anyone intended it to. A new entrant trying to run mail infrastructure faces a wall of deliverability problems that the established players simply don’t have, because deliverability is largely a function of already being established. The big providers didn’t have to lobby for this. Spam handed it to them. Every defensive measure that made sense against botnets also, as a side effect, made it harder to be small.
I don’t have a fix, and I’m suspicious of anyone who claims an easy one. You cannot reopen port 25 to consumer space without handing the botnets their cannon back; that trade is not close. The spam was real, the defense was necessary, and the centralization was the price. But it’s an honest thing to name the price instead of pretending email is still the open commons its protocol describes. Every RFC still reads like 1982 — any host, any peer, port 25, no gatekeeper. The wire still works that way. The world stopped, one blocked port at a time, and the most federated system we ever built quietly became a members-only club that keeps the old open door propped ajar mostly for decoration.