IPv4 SMTP (Port 25) not reachable externally, IPv6 works

maxischuh

Environment

Mail server hostname: mail.mydomain.tld (Mailcow, dockerized)
Recipient domain: example.org (e.g., info@example.org)
Public host IPs:
- IPv4: 198.51.100.35
- IPv6: 2001:db8:1c1c:cac::1
DNS (relevant):
- MX example.org → mail.mydomain.tld
- A mail.mydomain.tld = 198.51.100.35
- AAAA mail.mydomain.tld = 2001:db8:1c1c:cac::1
- SPF/DMARC/DKIM are present

—

Problem

Mail is intermittently delayed.
Current state: IPv6 SMTP is reachable, but IPv4 SMTP (port 25) from the Internet times out.
This causes deferrals for IPv4-only MTAs.

Earlier I saw a one-off 451 4.4.1 Connection refused on IPv6 delivery attempts; IPv6 is stable now.
The ongoing issue is IPv4 only (timeout).

—

What works / What doesn’t

✅ External IPv6:

  nc -6 -vz mail.mydomain.tld 25
  # -> succeeded

❌ External IPv4:

  nc -4 -vz mail.mydomain.tld 25
  # -> Operation timed out

✅ On the server itself (loopback + own public IPv4):

  nc -vz 127.0.0.1 25        # ok
  nc -vz 198.51.100.35 25    # ok

✅ Listening on both stacks:

  ss -lntp | grep ':25 '
  LISTEN 0 4096 0.0.0.0:25  ...
  LISTEN 0 4096 [::]:25     ...

✅ Docker port mapping: 0.0.0.0:25->25/tcp, [::]:25->25/tcp
✅ Host firewall: inactive (UFW off)

❌ IPv4 TCP traceroute reaches the destination hop but port 25 isn’t answered:

  traceroute -P TCP -p 25 -n 198.51.100.35
  ...
  10  198.51.100.35  14.1 ms  *  *

—

What I’ve tried

Verified DNS (MX → hostname, A/AAAA, SPF/DMARC/DKIM).
Tested reachability with nc, openssl s_client, and traceroute (results above).
Confirmed on the host: Postfix listens on v4/v6; local IPv4 connects succeed; Docker mappings are correct; UFW is disabled.
Checked cloud-firewall (provider Hetzner): inbound rules for destination TCP ports incl. 25/465/587/etc. are present and attached to the instance.

—

My questions

Have you seen cases where IPv4 port 25 inbound was blocked upstream while IPv6 was open (despite an “allow” rule)?
Any Mailcow/Docker specifics that could block external IPv4 even when ss / docker ps look correct?
Any ideas what happens here?

Thanks for any insights!

esackbauer

Are you on a supported platform (e.g. Debian or Ubuntu)
Did you enable anything like AppArmor or firewalld or ufw? Then try switching it off.
Is outbound traffic to port 53 TCP and UDP possible? This is important for RBL checks
Also check your MTU sizes maybe being too large. there are some reports on the forum regarding this.

maxischuh

esackbauer Thank you for your input!

I’m running the latest stable Ubuntu on ARM (hosted on Hetzner). I’ve got AppArmor and UFW disabled, and my Hetzner firewall for outbound traffic is fully open — no restrictions.

While checking MTU sizes, I noticed something odd: I can SSH into my server just fine, but I can’t ping it from my local machine.

Any idea what might be causing that?

ETNyx

Hello, since you are on Hetzner, did you request unblocking port 25?
Edit: FAQ

maxischuh

ETNyx Hi! Yes, the issue is also not sending but receiving emails. Sometimes emails are not delivered, which could be caused when the sender is using ipv4.

olmo1501

Did you check Hetzner Firewall? Maybe you did only allow IPv6 by mistake?

maxischuh

olmo1501 Yes I checked that. But thanks 🙂

[unknown] exim is not installed on the host. Thank you though 🙂

[unknown]

[unknown] exim is not installed on the host. Thank you though 🙂

maiyannah

Check that you do not have exim running.
Most distributions package exim by default and it will sit on port 25. I had to remove it before installing mailcow.