SMTP connect error 10060

SMTP connect error 10060 is a Windows Sockets (Winsock) error, WSAETIMEDOUT, not an SMTP reply code. Genuine SMTP reply codes are three digits in the 2xx to 5xx range (220, 421, 550) per RFC 5321. 10060 is raised at the TCP layer, before any SMTP conversation starts: your client opened a connection to the mail server and waited, but no response arrived before the timeout expired.

That timing is the key clue. Because the failure happens before the SMTP 220 greeting, causes like a wrong password or a bad recipient address are ruled out (those surface later as 535 or 550). A 10060 almost always means packets are being silently dropped somewhere on the path, most often a blocked port or a firewall.

What causes SMTP connect error 10060?

The connection attempt got no response and timed out. The common roots:

• Outbound port 25 blocked. The single most frequent cause. Most ISPs and cloud providers (AWS, GCP, Azure) block outbound TCP port 25 to curb spam, dropping the packets silently so the client just times out.
• Firewall or security software dropping packets. A local firewall, antivirus, or network appliance that silently discards traffic to the SMTP port produces a timeout rather than an explicit refusal.
• Wrong host or port. Connecting to a hostname or port where nothing answers (a typo, or an internal-only host) leaves the client waiting.
• Server down or overloaded. The mail server is unreachable or too busy to complete the handshake.
• DNS or routing problem. The hostname resolves to an address with no working route, for example an IPv6 (AAAA) address with no IPv6 path.

Note the distinction from the neighboring socket error: 10060 (WSAETIMEDOUT) means no response at all, while 10061 (WSAECONNREFUSED) means the host was reached and actively refused the connection, usually because nothing is listening on that port.

How do I fix SMTP connect error 10060?

1. Switch off port 25 to an authenticated submission port. Use 587 (STARTTLS) or 465 (implicit TLS), both valid per RFC 8314. These are not blocked the way port 25 is, so this change alone resolves most 10060 timeouts.

2. Test whether the port is reachable from the sending machine:

# STARTTLS (587)
openssl s_client -starttls smtp -connect smtp.yourprovider.com:587
# Implicit TLS (465)
openssl s_client -connect smtp.yourprovider.com:465

A 220 greeting means the path is open. If it hangs and then times out, a firewall, host, or ISP is blocking the port, and that has to be fixed at the network level. A quick reachability check is telnet smtp.yourprovider.com 587.

3. Confirm the host and port are correct and match your provider's documented submission settings.

4. Check firewalls and security software on the sending machine and network for rules that block outbound SMTP, and allow the submission port.

5. Force IPv4 if IPv6 has no route. If the host resolves to an IPv6 address your network cannot reach, connect over IPv4 instead.

If you are debugging this in Nodemailer, the same failure surfaces as ETIMEDOUT or ESOCKET; see the Nodemailer error reference for the connection-error codes.

When you send through Courier, you configure the SMTP host, port, and TLS mode once in the provider settings and Courier owns the socket connection, so an application-level 10060 from your own environment usually points at your local network path (a blocked port or firewall) rather than the delivery layer.