Stay organized with collections Save and categorize content based on your preferences.
This document describes the options for sending mail from a virtual machine (VM) instance and provides general recommendations on how to set up your instances to send email.
Using standard email portsGoogle Cloud does not place any restrictions on traffic sent to external destination IP addresses using destination TCP ports 587 or 465. The implied allow egress firewall rule allows this traffic unless you've created egress deny firewall rules that block it.
Due to the risk of abuse, connections to destination TCP Port 25 are blocked when the destination is external to your VPC network. This includes using SMTP relay with Google Workspace. However, some projects do not have this restriction and do allow external SMTP egress on port 25. For more information, see Blocked and limited traffic.
Note: Subject to Google Cloud firewall rules, connections to destination TCP Port 25 are allowed within your VPC network, a VPC connected using VPC Network Peering, or an on-premises network connected to your VPC network using Cloud VPN tunnels or Cloud Interconnect attachments (VLANs). Choosing a third-party email service to useIn addition to using standard email ports, having a trusted third-party email provider such as SendGrid, Mailgun, or Mailjet improves your IP reputation score.
SendGrid, Mailgun, and Mailjet offer a free tier for Compute Engine customers to set up and send email through their servers. If you don't have a Google Workspace account, use these third-party partners to take advantage of features like click tracking, analytics, APIs, and other features to meet your email needs.
Alternatively, if you are familiar with Google Workspace and are already paying for a Google Workspace account that supports email, you can set up a relay service to send email through Google Workspace. Note that Gmail and Google Workspace enforce limits for email activity.
If you don't have a Google Workspace account or don't want to use Google Workspace or a third-party mail provider, you can set up your own email server on an instance by using a non-standard port. You can choose any ephemeral port that isn't blocked by Compute Engine.
If you want to use your own email server on a custom port, use the documentation specific to your email service to configure a custom email port.
Setting up a firewall rule to allow outbound traffic on a custom portTo allow outbound traffic through a custom port, you need to set up a firewall rule. For example, the following steps set up a rule that allows outbound traffic on port 2525. Replace port 2525 with the custom port of your choice.
In the Google Cloud console, go to the Create a firewall rule page.
Choose a name for the firewall rule.
Under Network, select the network that is hosting the VM instance that you intend to send email messages from.
Under Direction of traffic, select Egress.
Under Targets, choose the appropriate target for this rule. For example, you might choose Specified target tags if you want the rule to apply to instances that have a specific tag.
Under Destination filter, set 0.0.0.0/0 if you want to allow egress traffic from the VM instance to any destination. If you want to limit the destination, enter another IP range here.
Under Protocols and ports, select Specified protocols and ports, select tcp, and enter 2525.
Click Create to save your changes.
In some cases, you might have a corporate mail server that is already running an email service for you. If you need to send mail through a corporate mail server but are blocked by the port restrictions described at the top of this page, you can use a VPN to bypass these restrictions. This method requires running a VPN client on your Compute Engine cluster, and a VPN server on your corporate network router. This setup lets your instance appear "inside" your corporate firewall, and allows unrestricted access to your corporate mail server.
There are security implications for this configuration, and you should ensure that your Compute Engine instance has access to only the services it requires, and nothing more.
What's nextExcept as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-08-08 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-08 UTC."],[[["Google Cloud allows sending email through standard ports 587 and 465, but blocks port 25 for external destinations to prevent abuse, though some projects might have exceptions to this rule."],["Utilizing third-party email services like SendGrid, Mailgun, or Mailjet is recommended for enhanced IP reputation, with free tiers available for Compute Engine customers."],["Google Workspace users can relay email through their accounts via ports 465 or 587, but are subject to email activity limits."],["Users can host their own email servers on VM instances using non-standard ports, which requires configuring a firewall rule to allow outbound traffic on that specific port."],["To send mail through corporate servers bypassing port restrictions, a VPN setup can be employed, but it's essential to consider the security implications and limit access accordingly."]]],[]]
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4