Smtp port 25 blocked over tunnel

We have a tunnel to allow access to internal servers via WARP client for people working from home.
Until yesterday sending and receiving email that way was working fine.
Since yesterday connections to port 25 are being silently dropped, so that people working from home can’t send any email (although they can still read email just fine).
We have setup zero trust gateway to log any network traffic that is blocked but we are not seeing anything in those logs,
As a temporary workaround we put a network override in place to map port 587 to port 25 which works but this requires everyone to reconfigure their email client.
Any ideas on what might have changed or how we can debug this issue?

from what i understand, cloudflare zero-trust cant protect SMTP.interesting.
how is your gateway policy configured.
also on any of those policies, does any of htem have any source/destonation port blocks?