diff --git a/cloudron-server-migration.md b/cloudron-server-migration.md
index 51ee6c3..a6cce5e 100644
--- a/cloudron-server-migration.md
+++ b/cloudron-server-migration.md
@@ -96,7 +96,24 @@ needed to restore are inside the thing being restored.
       25 — and it must be open, because the platform has **inbound mail enabled**:
       `GET /api/v1/mail` → `{"domain":"inference.coop","inbound":true,
       "dkimSelector":"cloudron","relay":{"provider":"cloudron-smtp"}}`. The DKIM selector
-      there matches the `cloudron._domainkey` TXT record, which is a useful cross-check. (mail delivery
+      there matches the `cloudron._domainkey` TXT record, which is a useful cross-check.
+
+      **How to verify rules before Cloudron is installed** — a blocked port *times out*,
+      a permitted port with no listener yet is *refused*. Both are informative; a timeout
+      is an absent rule.
+      **State on 2026-10-30:** the rules are applied on **IPv6** (80/443/465/587/993/995
+      refused = permitted; 8448/110/143/4190 dropped) but **NOT on IPv4** — everything
+      except 22 still times out. Infomaniak's console appears to keep separate IPv4 and
+      IPv6 rule sets. This must be fixed on both: IPv4-only clients, and Let's Encrypt's
+      HTTP-01 validation, are the ones that matter most, and 4190 (ManageSieve) stays shut
+      unless members need mail-filter clients.
+      **Port 25, settled from Cloudron's docs:** *inbound* 25 is **required to receive
+      email** and must be opened on both addresses. *Outbound* 25 is **not required if a
+      relay/smart host is configured** — Cloudron's own guidance is "request your provider
+      to unblock this port **or set up a smart host**", and this box already has
+      `relay: {"provider": "cloudron-smtp"}`. Confirm on the dashboard's Email page that
+      the relay is a real remote smarthost (host + port 465/587); if it is, Infomaniak's
+      outbound-25 restriction is irrelevant and worth no support ticket. (mail delivery
       — test from outside, e.g. `telnet my.inference.coop 25` once DNS moves; note that
       many networks block *outbound* 25, so a closed result from inside another server is
       not conclusive). **8448 is intentionally closed** — federation is delegated to