Sending email from a workspace

Workspaces cannot send email directly. Outbound connections to mail servers on TCP ports 25, 465, 587 are blocked, so a mail client, a local mail server or an SMTP library on the workspace gets a refused connection straight away. Receiving connections and everything on the workspace itself (localhost) are not affected.

Use an email API instead

Send through a transactional email service over HTTPS (port 443), which is open. Each has a Node.js and Python SDK and a free or low-cost starting tier:

Resend: an HTTP API and SDKs built for developers.
Postmark: transactional email with strong delivery.
Amazon SES: the AWS email service, called through the AWS SDK over HTTPS.

Keep the API key in an environment variable or a secrets file, not in the repository. Use the service's HTTP API rather than its SMTP relay: the relay listens on the blocked ports too.

Why it is blocked

Direct SMTP from cloud machines is the most common source of spam, and one abused machine can get the addresses of every workspace listed by mail providers. Blocking it by default keeps workspace addresses clean for everyone. The block is monitored, and a workspace used to send spam is suspended.