Skip to main content
If Ghost is installed on a DigitalOcean Droplet and staff invites, password resets or member signup emails fail with:
…the cause is almost always DigitalOcean’s outbound SMTP block. DigitalOcean blocks outbound traffic on ports 25, 465 and 587 on all Droplets by default, including Droplets using a Reserved IP. Ghost’s mail config can’t reach your mail provider, so the connection hangs until it times out.

​
Fix

Most mail providers offer an alternative submission port that isn’t blocked. Mailgun accepts SMTP on port 2525, so set the host and port explicitly in your config.production.json:
Run ghost restart for the change to take effect, then send a test invite to confirm mail is working.
Don’t add "service": "Mailgun" to this config. Ghost uses Nodemailer under the hood, and its service presets are applied after your own options, not before. The Mailgun preset sets port 465 with implicit TLS, so it silently overrides an explicit port of 2525 and the connection times out again. Omit service entirely and set host and port yourself.
Port 2525 doesn’t support implicit TLS, so secure must be false. Setting requireTLS to true makes Nodemailer upgrade the connection with STARTTLS and fail the send if the upgrade doesn’t succeed. Without it, Nodemailer only attempts STARTTLS when the server advertises support for it, and otherwise continues unencrypted.
If you use a provider other than Mailgun, check their documentation for a supported alternative port — 2525 is a common choice, but it isn’t universal.

​
Newsletters are unaffected

This only affects transactional email sent over SMTP. Bulk email for newsletters is sent through the Mailgun API over HTTPS, which DigitalOcean doesn’t block — see why Mailgun is required.