> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ghost.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Connection timeout when sending email on DigitalOcean

> DigitalOcean blocks outbound SMTP on ports 25, 465 and 587 by default, which causes Ghost to fail with a connection timeout when sending transactional email.

***

If Ghost is installed on a DigitalOcean Droplet and staff invites, password resets or member signup emails fail with:

```
Failed to send email. Reason: Connection timeout.
```

...the cause is almost always DigitalOcean's [outbound SMTP block](https://docs.digitalocean.com/support/why-is-smtp-blocked/). DigitalOcean blocks outbound traffic on ports **25**, **465** and **587** on all Droplets by default, including Droplets using a Reserved IP. Ghost's mail config can't reach your mail provider, so the connection hangs until it times out.

## Fix

Most mail providers offer an alternative submission port that isn't blocked. Mailgun accepts SMTP on port **2525**, so set the host and port explicitly in your `config.production.json`:

```json theme={"dark"}
// config.production.json

"mail": {
  "transport": "SMTP",
  "options": {
    "host": "smtp.mailgun.org",
    "port": 2525,
    "secure": false,
    "requireTLS": true,
    "auth": {
      "user": "postmaster@example.mailgun.org",
      "pass": "1234567890"
    }
  }
},
```

Run `ghost restart` for the change to take effect, then send a test invite to confirm mail is working.

<Warning>
  Don't add `"service": "Mailgun"` to this config. Ghost uses [Nodemailer](https://nodemailer.com/smtp/well-known-services/) under the hood, and its `service` presets are applied **after** your own options, not before. The `Mailgun` preset sets port `465` with implicit TLS, so it silently overrides an explicit `port` of `2525` and the connection times out again. Omit `service` entirely and set `host` and `port` yourself.
</Warning>

<Note>
  Port 2525 doesn't support implicit TLS, so `secure` must be `false`. Setting `requireTLS` to `true` makes Nodemailer upgrade the connection with STARTTLS and fail the send if the upgrade doesn't succeed. Without it, Nodemailer only attempts STARTTLS when the server advertises support for it, and otherwise continues unencrypted.
</Note>

If you use a provider other than Mailgun, check their documentation for a supported alternative port — 2525 is a common choice, but it isn't universal.

## Newsletters are unaffected

This only affects transactional email sent over SMTP. Bulk email for newsletters is sent through the Mailgun API over HTTPS, which DigitalOcean doesn't block — see [why Mailgun is required](/faq/mailgun-newsletters/).