Environment

Mail server hostname: mail.mydomain.tld (Mailcow, dockerized)
Recipient domain: example.org (e.g., info@example.org)
Public host IPs:
- IPv4: 198.51.100.35
- IPv6: 2001:db8:1c1c:cac::1
DNS (relevant):
- MX example.org → mail.mydomain.tld
- A mail.mydomain.tld = 198.51.100.35
- AAAA mail.mydomain.tld = 2001:db8:1c1c:cac::1
- SPF/DMARC/DKIM are present

—

Problem

Mail is intermittently delayed.
Current state: IPv6 SMTP is reachable, but IPv4 SMTP (port 25) from the Internet times out.
This causes deferrals for IPv4-only MTAs.

Earlier I saw a one-off 451 4.4.1 Connection refused on IPv6 delivery attempts; IPv6 is stable now.
The ongoing issue is IPv4 only (timeout).

—

What works / What doesn’t

✅ External IPv6:

  nc -6 -vz mail.mydomain.tld 25
  # -> succeeded

❌ External IPv4:

  nc -4 -vz mail.mydomain.tld 25
  # -> Operation timed out

✅ On the server itself (loopback + own public IPv4):

  nc -vz 127.0.0.1 25        # ok
  nc -vz 198.51.100.35 25    # ok

✅ Listening on both stacks:

  ss -lntp | grep ':25 '
  LISTEN 0 4096 0.0.0.0:25  ...
  LISTEN 0 4096 [::]:25     ...

✅ Docker port mapping: 0.0.0.0:25->25/tcp, [::]:25->25/tcp
✅ Host firewall: inactive (UFW off)

❌ IPv4 TCP traceroute reaches the destination hop but port 25 isn’t answered:

  traceroute -P TCP -p 25 -n 198.51.100.35
  ...
  10  198.51.100.35  14.1 ms  *  *

—

What I’ve tried

Verified DNS (MX → hostname, A/AAAA, SPF/DMARC/DKIM).
Tested reachability with nc, openssl s_client, and traceroute (results above).
Confirmed on the host: Postfix listens on v4/v6; local IPv4 connects succeed; Docker mappings are correct; UFW is disabled.
Checked cloud-firewall (provider Hetzner): inbound rules for destination TCP ports incl. 25/465/587/etc. are present and attached to the instance.

—

My questions

Have you seen cases where IPv4 port 25 inbound was blocked upstream while IPv6 was open (despite an “allow” rule)?
Any Mailcow/Docker specifics that could block external IPv4 even when ss / docker ps look correct?
Any ideas what happens here?

Thanks for any insights!