Port 10026 — Amavisd Mail Filtering

What This Port Carries

Port 10026 is unassigned by IANA, but it has a de facto purpose: Amavisd mail filtering. When you send or receive email through a mail server running Amavisd, your message passes through port 10026 for content scanning, antivirus checking, and spam filtering. Then it moves on. You never see it.

The Port Range: What Unassigned Means

Port 10026 sits in the registered port range (1024–49151), which means:

• It's not a well-known port (those are 0–1023, assigned for essential protocols like HTTP, SSH, DNS)
• It could be registered with IANA, but it isn't
• Software vendors can use it informally for their own purposes
• There's no official protocol standard or RFC defining what should run here

This creates a strange situation: the port isn't wild and chaotic (like the ephemeral range 49152–65535), but it's not officially governed either. It's a kind of commons where software vendors settle in with community agreement but no formal blessing.

How Port 10026 Actually Works

In a typical mail server setup:

1. Incoming SMTP traffic arrives on port 25 (or port 10025 for a proxy)
2. The mail server forwards the message to Amavisd on port 10026
3. Amavisd scans the message: virus check, spam scoring, content filtering
4. If clean, the message gets forwarded back to the mail server on port 10024
5. The cleaned email continues to its destination

Port 10026 is the outbound side of this filtering pipeline. It's where Amavisd hands processed mail back to Postfix, Sendmail, or other MTAs.

Common configurations:¹

• Port 10024 — Amavisd inbound (receives unscanified mail)
• Port 10026 — Amavisd outbound (returns cleaned mail)
• Port 9998 — Alternative Amavisd port on some systems

If you ever see "Connection refused on port 10026," it means Amavisd crashed or never started. Your mail server will queue messages and keep retrying. Eventually they bounce. All because an unregistered port stopped listening.

Why Unassigned Ports Matter

Official assignments (like IANA registration) matter because they prevent conflicts. When two vendors choose the same port number, chaos follows. Port 10026 survived without formal registration because:

• Email administrators standardized on it organically
• Amavisd became the de facto standard for mail filtering on Linux
• Enough systems use it that changing it would break thousands of deployments

But this also means port 10026 could theoretically be claimed by something else. In practice, it won't be—the ecosystem decided this port belongs to mail filtering, and that's enough.

Checking What's Listening

To see if Amavisd is running on your system:

# Check if port 10026 is listening
lsof -i :10026
netstat -tuln | grep 10026
ss -tuln | grep 10026

# Check if Amavisd process exists
ps aux | grep amavisd

# View Amavisd logs (typical locations)
tail -f /var/log/amavis.log
tail -f /var/log/mail.log

If the port is open, Amavisd is scanning mail. If it's closed, your email is either not being filtered or using a different port.

The Unregistered Port Ecosystem

Port 10026 belongs to a strange middle ground:

• Too specific to be chaos (not ephemeral)
• Too informal to be guaranteed (not registered)
• Too widely deployed to change (used by thousands of mail servers)

It's a port that exists because it needed to exist, not because anyone planned it. That's honest infrastructure.

• SpeedGuide port 10026 reference
• iRedMail support - port 10026 connection issues
• Sophos Community - SMTP port 10025 and 10026 configuration
• DKIM proxy with Postfix - dkimproxy documentation