whatportis.com
suggest an edit →

Port 10025Zimbra SMTP Amavis Integration

Port 10025 is commonly used internally within Zimbra Collaboration Suite to facilitate the relay of email messages from the Amavis content filter back into the Postfix Mail Transfer Agent (MTA). This port enables scanning and filtering of emails for malware, spam, or policy compliance before final delivery, serving as a secure and structured point of reinjection after content analysis..

inEmailSecuritySystem
transport
tcp

single transport

in transit
cleartext

payload readable on path

assignment
unofficial

used by convention

risk
4/10

caution

lookups
8,772

rank 574 of 993 · top 58%

Technical Details

what runs on :10025

Port 10025 is primarily utilized in mail server infrastructures, especially those leveraging the Zimbra Collaboration Suite, which integrates Postfix as its core MTA along with Amavis for antivirus and antispam filtering. When an email enters Zimbra’s Postfix instance, it can be routed through Amavis for content filtering. After filtering and analysis, the email is then passed back into Postfix on port 10025 for further processing toward the intended recipient mailbox.

This reinjection architecture helps to separate clean email traffic from unverified or potentially malicious content. Amavis listens on one port (commonly 10024) to receive emails from Postfix, performs its filtering, then relays the sanitized message to Postfix on port 10025. This workflow ensures scanned emails can be tracked and managed distinctly, simplifying filtering logic and contributing to a layered security posture.

Normally, port 10025 is bound to localhost or internal network interfaces, as it’s intended purely for inter-process communication within the mail system. It’s not an Internet-facing or client-used port like 25 or 587, meaning it serves a specialized, backend role in the mail delivery pipeline within Zimbra hosts.

Security Information

exposure of :10025

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

email averages 3.9 across 42 ports — this one sits 0.1 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

Common Vulnerabilities:

  • If port 10025 is inadvertently exposed externally, it could be exploited for mail injection attacks or relay abuse, bypassing normal submission controls.
  • Misconfiguration of access controls or authentication can allow unauthorized processes or users to submit messages on this port.
  • Malicious content could attempt to exploit vulnerabilities in Amavis or the Postfix reinjection process if sanitization is insufficient.

Common Mitigations:

  • Restrict port 10025 to localhost or trusted management network interfaces using firewall policies and service bind configuration.
  • Implement robust access controls so only the trusted Amavis process can relay through this port.
  • Keep Amavis and Postfix updated to mitigate known vulnerabilities.
  • Apply strict mail filtering and content sanitation policies before reinjection occurs.
  • Monitor logs to detect unusual relay activity or abuse patterns on internal SMTP ports.

Related Ports

all 42 in email →

the 8 most looked-up other ports in email — 42 ports carry that label.

portservicerisk
:143IMAPcaution
:995POP3Scaution
:109POP2caution
:2096cPanel SSL Webmailsafe
:110POP3caution
:993IMAPScaution
:1352Lotus Notes RPCcaution
:24Private Mailcaution

risk mix of the 8 listed

  • safe13%
  • caution88%

3 of 8 encrypted