Skip to content
Mail TesterMail DoctorIMAP MigrationList VerificationArchive RecoveryMonitoring
What is my IP addressDNS Propagation CheckerTCP Port CheckerMTA-STS and TLS-RPT CheckerDNSSEC checkSecurity Headers CheckerSPF, DKIM and DMARC CheckerWHOIS and Domain LookupEmail Header AnalyzerSSL Certificate CheckDNS and MX LookupBlacklist CheckIs It DownSpeed testPassword generator

TCP Port Checker

Type a host and a port. You get whether something answers, what it said if it said anything, and — when nothing answers — which of the two kinds of “no” it is.

Common ones

Checked from our server, not from you

This matters most for port 25. Almost every home and mobile provider blocks outbound 25, so a mail server can be perfectly open from here and unreachable from your laptop — both true at once, and the fix is neither on the server nor on your machine. If you are testing whether YOU can send mail, this answers a different question.

Refused and silent are not the same “no”

A refusal is the machine answering: it is up, the packet reached it, and nothing is listening on that port. You start the service, or you look at which address it bound to. Silence is a firewall dropping the packet without a word — and that rule is usually somewhere else entirely: a cloud security group, the provider’s own filter, a box in front. Every other port checker calls both of them “closed”, and half the people who read that go and restart a service that was already running.

What this does not tell you

Whether the service works. An open port and a greeting mean something accepted a connection and said hello; they say nothing about whether it will authenticate you, whether its certificate is valid, or whether it is the software you think. And it only probes TCP — UDP services like DNS or VPNs do not answer this way at all.

If you are here, this is usually what comes next

If this is about mail, there is more to look at

A reachable port 25 is one line of a mail setup. Mail Doctor adds the MX, the reverse DNS, SPF, DKIM, DMARC, the transport TLS and the blacklists, scores it out of ten and puts the fixes in the order that matters.

See Mail Doctor →

Frequently asked questions

It says my port is open, but I still cannot connect.
Then both are true, and the difference is where you are standing. We connect from a datacentre with nothing filtered on the way out; you are probably behind an ISP, an office firewall or a mobile network that blocks the port outbound. Port 25 is the classic: nearly every residential provider has blocked outbound 25 for twenty years, to stop infected machines sending spam. Use 587 with authentication instead, which is what it is for.
What is the difference between refused and silent, in practice?
Who you have to talk to. Refused means the machine answered you, so it is reachable and the service is simply not running there — you fix that on the machine, usually by starting it or by checking it is not bound to 127.0.0.1 only. Silent means something in between threw your packet away without telling anyone, so the machine may be perfectly healthy and the rule you need to change is in a firewall, a security group, or your provider’s network.
Is scanning someone else’s ports allowed?
This checks one port at a time, on a host you type, which is what any client does when it connects to a service. It is not a scanner and it is rate limited so it cannot be used as one. Probing a machine you have no business with is still rude and, depending on where you are, worse than rude — so check your own, or ones you have been asked to check.