Port 25 is the SMTP port for server-to-server transport: your MX receives mail from the internet here. TLS is negotiated via STARTTLS, but opportunistically – without MTA-STS or DANE an attacker can strip it.
A mail server needs port 25 open inbound. For mail clients it is the wrong port: they submit through 587 or 465 with authentication.
Typical problem: outgoing mail stuck in the queue with Connection timed out. Many cloud and hosting providers and consumer ISPs block outbound port 25 – request unblocking or use a smarthost relay on 587.
Check
openssl s_client -starttls smtp -connect mx.example.com:25 -crlf