Home / Guides / Self-hosting behind CGNAT

Home mail server behind CGNAT: why port 25 matters more

Receiving mail at home means other mail servers have to reach yours on port 25. CGNAT stops that, but even with a public IP, several large ISPs block port 25 on home lines. Check both before you set anything up.

Why CGNAT gets in the way

Mail moves between servers over TCP port 25 (RFC 5068, section 3). To receive mail, other servers have to connect into your network on that port. Behind CGNAT, your router has no public IPv4 address of its own, so those connections stop at the ISP's NAT (RFC 6269, section 5.2.1). A shared address hurts sending too: anti-abuse limits that count connections per address can treat everyone behind the shared IPv4 as one sender (RFC 7021, section 3).

CGNAT often isn't the biggest obstacle, though. Some providers block all outbound port 25 mail from home lines, and some filter inbound port 25 as well. The IETF's email submission best practice notes the outbound practice, takes no position on it, and says access providers must not block the separate submission port 587 that mail apps use to send through a mail provider (RFC 5068, sections 4 and 4.1).

What works and what doesn't

Reading and sending mail through a mail provider from home: unaffected. Mail apps send on submission port 587, which access providers aren't supposed to block.
Receiving mail from other servers over IPv4: blocked behind CGNAT, and also blocked on lines where the ISP filters inbound port 25.
Sending mail straight from your home server to other servers on port 25: blocked on some home lines whether or not the ISP uses CGNAT. Some ISPs block outbound port 25 even where inbound is open.
Over IPv6: the CGNAT is out of the way, but a port 25 block can still apply (Xfinity lists port 25 as blocked over IPv6 too), and senders that only use IPv4 still can't reach you.

Which ISPs block port 25

We have a port 25 answer from the ISP's own pages for 8 of the 41 ISPs we track: 4 block or filter it, 3 don't list it as blocked, and 1 depends on the plan. The other 33 are unverified, which doesn't mean open. Blocks can be inbound, outbound or both; the notes say which where the ISP does.

Astound (RCN / Wave / Grande / enTouch): Blocked. On dynamically addressed residential lines (Astound's network management disclosure).
Cox: Blocked. Cox's filtered-ports table: TCP 25 filtered in both directions.
EPB Fiber: Not blocked. EPB blocks outbound port 25 to outside mail servers only and says all other traffic is permitted.
Glo Fiber (Shentel): Not blocked. Glo Fiber's HOA FAQ says it doesn't block any inbound ports.
Midco: Blocked. Midco lists port 25 (SMTP) as blocked on its network. The page doesn't say whether that's inbound, outbound or both.
Optimum (Altice): Depends on plan. Per Optimum's terms: no servers at all on Optimum 25 and below; on Optimum 650 and above, a mail (SMTP) server is allowed. We found no published network block.
Spectrum (Charter): Not blocked. Not on Spectrum's published list of blocked ports. Spectrum's residential terms still limit service to personal, non-commercial use.
Xfinity (Comcast): Blocked. Xfinity's blocked-ports list: TCP 25 blocked in both directions (IPv4 and IPv6).

Filter the ISP finder for no CGNAT and port 25 not blocked, or compare all three server ports in the finder.

Check whether you're behind CGNAT

Compare your router's WAN address with your public IP using the CGNAT checker or the step-by-step guide. A WAN address between 100.64.0.0 and 100.127.255.255 is the CGNAT range (100.64.0.0/10 explained). If the two addresses match, CGNAT isn't your problem; check the port forward and any inbound port blocks your ISP lists.

What to ask your ISP

"Can you move my line off CGNAT and give me my own public IPv4?" Some ISPs do this for free on request; others only with a paid static IP.
"Do you sell a static IP on residential plans, and what does it cost?" Some ISPs only sell it on business plans.
"Is IPv6 available on my line, and is it turned on?" IPv6 doesn't go through the CGNAT, but the other side needs IPv6 too.
"Is port 25 blocked on my line, inbound or outbound, and can you lift it?"
"Can you set reverse DNS for my address?" Every address should have a matching reverse (PTR) name, and services may refuse to talk to hosts that don't (RFC 1912, section 2.1). Only the ISP that holds the address can set it.
"Do my plan's terms allow a mail server?" Some don't. Optimum's terms, for example, allow a mail server only on faster plans. Each ISP page quotes the server rules we found.

If you do run one, make sure it only accepts mail for your own domains and only sends for logged-in users. A server that relays mail for anyone gets found and abused quickly.

Which ISPs make this easier

Of the 41 ISPs we track, 12 give home customers a public IPv4 by default, 3 offer a free CGNAT opt-out and 8 sell a static IP on home plans, per our sources. See ISPs without CGNAT, ISPs that use CGNAT, or filter the ISPs without CGNAT where port 25 isn't blocked in your state. Each ISP page also quotes what the terms say about running servers at home.

FAQ

Can I run a mail server at home behind CGNAT?

Not for receiving mail over IPv4. Other mail servers connect to yours on port 25, and behind CGNAT those connections stop at the ISP's NAT. You need a public IPv4 from your ISP, and port 25 must not be blocked on your line.

Is CGNAT or the port 25 block the bigger problem?

Often the port 25 block. Several of the ISPs we track block or filter port 25 on home lines whether or not they use CGNAT, so a public IP alone may not be enough. Each ISP page here shows the port 25 status we could verify from the ISP's own pages.

Will my ISP block port 587?

It shouldn't. The IETF best practice for email submission says access providers must not block port 587, which mail apps use to send through a mail provider. Running your own mail server is different: it needs port 25.

What should I ask my ISP?

Ask whether it can move you off CGNAT to a public IPv4 or sell a static IP, whether port 25 is blocked inbound or outbound and whether that can be lifted, whether it can set reverse DNS for your address, and whether your plan's terms allow a mail server.

This site sticks to ISP facts. It doesn't review or recommend third-party products or services.