Lovely explication, @mpalmer. Crickets from Digital Ocean.
I’ve changed my install script to use 2525 since there’s no easy way to tell whether 587 is blocked (my script blindly pipes values into ./discourse-setup so that I’m continually making sure that it’s working correctly).
It appears that people who use Digital Ocean and want to get their ports un-blocked need to file a ticket to request that, which is not something I’m willing to ask my install customers to do if at all possible.
I’ll try to add such a test to ./discourse-setup in the next week.