Enable SMTP Receipt Through Firewalld on Linux – How to

I've leased a dedicated, lightly-managed CentOS7 box from a hosting company. The host came with firewalld installed and running and with its iptables preferences pre-imposed.

I was not expecting this; I'm used to receiving unfirewalled boxes with no services running on them except the ones I turn on. I know little about firewalld and iptables and am struggling to get even basic external email traffic through port 25 and into postfix's queue. I believe it's the firewall that's blocking me because:

• All my DNS records are set up properly. Those haven't changed in years; all I had to do was update the IP addresses to accommodate this new host.

• netstat -ln confirms the port is listening; I can telnet localhost 25 and even negotiate EHLO, etc. just fine

• My postfix configuration is probably correct but also irrelevant. I'm not testing features like aliases or virtual domains: I'm just sending to real-local-user@postfix-$mydestination-entry. And when I send the message from localhost, it gets delivered just fine.

• I've upped the verbosity of the postfix qmgr daemon, and no matter how much mail I send from outside the machine, its logs never indicate that any messages are making it to the queue. All it reports is every 5 minutes waking up to do some routine actions.

The relevant zone of firewalld looked like this when I got the machine:

public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: http ssh https
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

I have now managed to make it look like this (all hidden lines remain the same):

public
  target: default
  services: http ssh https smtp
  ports: 25/tcp

(I made the changes --permanent and --reloaded after each one.)

Unfortunately, I'm still unable to telnet host 25 from remote locations and remote mail still fails to reach my postfix queue. Any thoughts as to what I'm missing?

P.S. Notice that http is in the same firewalld zone and I've been able to telnet host 80 and connect via web browser since day 1.

P.P.S. I've avoided posting anything about iptables output here because I do not in fact know what portions of that are relevant. I'm hoping someone will be able to deduce my problem without that info, but if not then I can certainly dig it up …