SMTP Port 25 vs 465 vs 587: Which to Use and How to Test It

SMTP port 25 vs 465 vs 587 comes down to who is sending: port 25 carries mail between servers, 587 is where an authenticated mail client submits messages and upgrades to TLS with STARTTLS, and 465 is the same submission service with TLS from the first byte. For a client or app, use 465 or 587 — never 25.

To receive mail, a client uses IMAP (993 with SSL/TLS or 143) or POP3 (995 with SSL/TLS or 110). Entering port 25 for outgoing mail in a client is the misconfiguration behind most "cannot send" reports: the connection times out because the network blocks it, or the server refuses to relay without authentication.

This guide covers what each email port does, the real difference between 465 and 587, which ports Gmail and Microsoft 365 expect, why ISPs and cloud hosts block port 25, what the typical error messages mean, and how to test a port with openssl, nc, PowerShell and swaks.

What email ports are and why they matter

An email port is the number over which a mail client or server opens a TCP connection to another server to move messages. Each stage of delivery — server-to-server relay, submission of a message from a client, and mail retrieval — has its own standard ports assigned to the SMTP, POP3, and IMAP protocols.

Choosing the right port affects not only whether mail works but also its security: whether the connection is encrypted and when TLS is established determines how well your login, password, and message contents are protected against interception.

SMTP ports list: 25, 587, 465 and 2525

SMTP (Simple Mail Transfer Protocol, RFC 5321) handles sending. It has three standard ports plus one widely used unofficial alternative, and confusing them is one of the most common reasons mail fails to send.

SMTP port 25 — server-to-server relay (MTA-to-MTA)

Port 25 is the original SMTP port and still the default SMTP port number for delivery between mail servers (MTAs). When the sender's server delivers a message to the recipient's server, it looks up the recipient domain's MX record and connects to port 25 on that host. There is no other port for this hop: MX delivery always happens on 25, so a mail server that cannot reach remote port 25 cannot deliver directly to the internet.

Encryption on port 25 is opportunistic: servers advertise STARTTLS and use it if both sides support it, but by default a sending server falls back to cleartext rather than fail. Using port 25 to send mail from an email client is discouraged and often impossible.

Port 587 — submission with STARTTLS

Port 587 is defined in RFC 6409 as the message submission port — this is how an email client hands a message to the provider's server. The connection starts in cleartext and is upgraded to encrypted via the STARTTLS command (RFC 3207). It requires authentication (SMTP AUTH). SMTP port 587 is the most widely supported choice for configuring outgoing mail in clients, apps, printers and scanners.

Port 465 — SMTPS with implicit TLS

Port 465 uses implicit TLS: encryption is established immediately on connect, before any SMTP commands. For years it was considered deprecated, but RFC 8314 (2018) rehabilitated it and recommends implicit TLS for submission. Today both 465 and 587 are valid choices; which to use depends on provider support.

Port 2525 — unofficial fallback

Port 2525 is not registered with IANA for SMTP. Many email sending services (for example SendGrid and Mailgun) accept submission on 2525 as an alternative for networks that block 587 or 465. It behaves like 587 — STARTTLS plus authentication — but only works if your provider explicitly supports it.

Is port 465 used for SMTP?

Yes. Port 465 is used for SMTP message submission over implicit TLS, often shown in client settings as "SSL/TLS" or "SMTPS". Its history explains why so many forum answers still say otherwise. IANA assigned 465 to SMTP over SSL in the late 1990s, then revoked it once STARTTLS on port 25 and later 587 became the standard path, and the number was reassigned to another service. Clients and providers kept using 465 anyway.

In 2018 RFC 8314 reversed the position: it registered port 465 as submissions (message submission over TLS) and recommends implicit TLS over STARTTLS for mail clients. Advice such as "465 was reassigned by IANA, use 587" is therefore outdated — 465 is a standards-track SMTP submission port again.

What is the difference between port 465 and 587?

Both ports do the same job: an authenticated client submits outgoing mail to its provider, which then relays it onward over port 25. The difference is only in when TLS starts.

Practical rule: if your provider offers 465, use it; if not, use 587 and make sure the client is set to require STARTTLS rather than "use if available".

Is Gmail SMTP port 465 or 587?

Both. Gmail's outgoing server smtp.gmail.com accepts port 465 with SSL/TLS and port 587 with STARTTLS (often labeled "TLS" in client settings), and both require authentication. With 2-Step Verification enabled, a regular client usually needs an app password or an OAuth sign-in instead of your normal Google password; a "Username and Password not accepted" error in the SMTP log is the usual symptom.

Google Workspace domains can also use the SMTP relay service smtp-relay.gmail.com, which accepts ports 25, 465 and 587 and authenticates by IP address or credentials configured in the Admin console. Microsoft 365 client submission uses smtp.office365.com on port 587 with STARTTLS. Provider settings change over time, so confirm them in the provider's current documentation.

Is SMTP over TCP or UDP?

SMTP runs over TCP only — and so do IMAP and POP3. Mail delivery needs a reliable, ordered byte stream for the command/response dialogue and the message body, which is exactly what TCP provides. The IANA registry lists a UDP entry next to many port numbers, including 25, but mail software never uses it. When you write firewall rules or security-group rules for a mail server, open TCP 25, 465, 587, 993 and 995 (plus 143 and 110 only if you really need them); opening UDP for these ports does nothing.

Retrieval ports: POP3 and IMAP

Two protocols are used to receive mail. POP3 downloads messages to a device and usually deletes them from the server, while IMAP synchronizes mailbox state across all devices and keeps messages on the server. The trade-offs are covered in detail in IMAP vs POP3.

POP3 — ports 110 and 995

Port 110 is POP3 without encryption (or with STARTTLS). Port 995 is POP3 over implicit TLS (POP3S), the secure variant. For any modern mailbox you should use 995.

IMAP — ports 143 and 993

Port 143 is IMAP without encryption (or with STARTTLS). Port 993 is IMAP over implicit TLS (IMAPS). Port 993 is preferred because it encrypts the connection from the first second and is recommended by RFC 8314.

Email ports table

SMTP TLS port: STARTTLS versus implicit TLS

The difference between the two encryption models is fundamental. With STARTTLS (ports 587, 143, 110) the connection opens in cleartext, then the client issues the STARTTLS command to switch it to TLS. With implicit TLS (ports 465, 993, 995) encryption is enabled immediately when the TCP connection is established. So the SMTP secure port number, in the strict sense, is 465; 587 becomes secure only once STARTTLS succeeds.

Implicit TLS is considered more resilient against downgrade attacks, where an attacker strips the STARTTLS command and forces the connection to stay in cleartext. That is why RFC 8314 recommends preferring implicit TLS for new configurations: 465 for sending, 993 for IMAP, 995 for POP3.

Key rule: STARTTLS without enforced verification can be stripped by an attacker. If your provider supports implicit TLS (465/993/995), choose it.

Between servers on port 25 the same stripping risk exists, and there is no implicit-TLS alternative. Domains that want delivery to them to be encrypted publish an MTA-STS policy, which tells sending servers to require valid TLS instead of falling back to cleartext.

Why port 25 is blocked by ISPs and hosts

Many internet service providers and cloud hosts block outbound connections to port 25. The reason is historical: infected computers sent spam en masse directly through port 25, bypassing controls. Blocking port 25 on client networks sharply reduced spam volume.

Practical consequences:

• Home internet usually won't let you connect to an external port 25 — send mail through your provider's 587 or 465.
• Cloud providers restrict outbound port 25 by default: AWS lifts the restriction on request, Google Cloud blocks it for Compute Engine, and Azure blocks it on most subscription types. Many VPS hosts open it only after a request with a justification. The usual answer is to relay through a provider on 587 or 465.
• If you run your own mail server, port 25 is needed to receive inbound mail from other servers — blocking it inbound is different from blocking it outbound.

If mail won't send and the logs show a timeout on port 25, the ISP is almost certainly blocking outbound connections. Switch to a submission port.

Common SMTP port errors and what they mean

Rejections that arrive after a successful submission, such as 550 or 554 from the recipient's server, are about reputation and authentication rather than ports — see SPF, DKIM and DMARC: the complete guide.

Which port to choose in your email client

When configuring an email client (Outlook, Thunderbird, Apple Mail, mobile apps), follow a simple scheme:

1. Outgoing mail (SMTP): port 465 with SSL/TLS or port 587 with STARTTLS. Always enable username-and-password authentication.
2. Incoming mail, IMAP: port 993 with SSL/TLS (preferred). Port 143 only if 993 is unavailable.
3. Incoming mail, POP3: port 995 with SSL/TLS. Port 110 only as a fallback.

Always confirm the exact values in your provider's documentation — some services support only one of the submission ports. Never use port 25 in client settings.

Ports for your own mail server

If you run the server yourself, open inbound TCP 25 so other servers can deliver to you, plus 465 and/or 587 for your users' clients and 993 (and 995 if you offer POP3) for retrieval. In Postfix, submission ports are separate services in master.cf: the submission service on 587 is typically run with -o smtpd_tls_security_level=encrypt and -o smtpd_sasl_auth_enable=yes, and the service on 465 (named smtps or submissions depending on the Postfix version) adds -o smtpd_tls_wrappermode=yes for implicit TLS. Keep SASL authentication off on port 25 — it is for receiving, not for your users.

How to check whether a port is open

Before troubleshooting client settings, it helps to confirm the port is reachable at all and that a mail server with correct TLS is actually listening on it.

Test the TLS handshake on a submission port (STARTTLS):

openssl s_client -connect smtp.example.com:587 -starttls smtp

Test implicit TLS on port 465 or IMAPS 993:

openssl s_client -connect smtp.example.com:465
openssl s_client -connect imap.example.com:993

Quickly check whether a TCP port is open without a TLS handshake:

# via telnet
telnet smtp.example.com 587

# or via netcat (quieter, better for scripts)
nc -vz smtp.example.com 587

On Windows, PowerShell has a built-in test that reports TcpTestSucceeded : True when the port answers:

Test-NetConnection smtp.example.com -Port 587

To test the whole submission path — TLS plus authentication plus an actual message — swaks is the standard tool. --tls uses STARTTLS, --tls-on-connect uses implicit TLS:

# port 587, STARTTLS
swaks --to you@example.org --from you@example.com --server smtp.example.com --port 587 --tls --auth LOGIN --auth-user you@example.com

# port 465, implicit TLS
swaks --to you@example.org --from you@example.com --server smtp.example.com --port 465 --tls-on-connect --auth LOGIN --auth-user you@example.com

If the connection hangs or times out, the port is blocked by a firewall or the ISP. If openssl shows the certificate chain and a line with the TLS version, the server is configured correctly. A plain connection to 25 or 587 should answer with a 220 greeting; after EHLO, look for 250-STARTTLS in the capability list, and for 250-AUTH once TLS is up. More test scenarios, including relay and PTR checks, are in How to test a mail server.

Don't want to work in the command line? Use our port availability checker — enter a host and port number and it reports reachability in a couple of seconds, including from multiple regions. The SMTP test connects to a mail server and shows its greeting, STARTTLS support and certificate, and the port scanner checks 25, 465, 587, 993 and 995 on your own host in one pass.

Related reading

Setting up email goes beyond ports. For messages to arrive and stay out of spam, you need correct DNS records and server monitoring:

• MX records: setting up email for a domain — where to route inbound mail.
• SPF, DKIM and DMARC: the complete guide — email authentication against spoofing.
• Mail server monitoring — how to track availability and queues.

FAQ

What is the default SMTP port number?

Port 25 is the default SMTP port for delivery between mail servers. For sending from a client or application, the default submission ports are 587 (STARTTLS) and 465 (implicit TLS). If a form just asks for "SMTP port" in an app, it almost always means 587 or 465.

Why won't my mail send over port 25?

Most ISPs and cloud hosts block outbound connections to port 25 to fight spam. Port 25 is meant for relaying mail between servers, not for sending from a client. To send messages, use submission port 587 or 465 with authentication enabled.

Which is safer — STARTTLS or SSL/TLS?

Implicit TLS (SSL/TLS on ports 465, 993, 995) is more robust because encryption is enabled the moment you connect. STARTTLS opens the connection in cleartext, and an attacker could in theory strip the command that switches to TLS. When you have a choice, prefer implicit TLS.

Do I need to open port 25 on my own server?

Yes, if your server receives inbound mail from other servers — they connect to your MTA's port 25. Blocking port 25 inbound makes the domain unable to receive mail. Blocking it outbound (at the ISP) is a separate matter and affects only outgoing connections.

What's the difference between POP3 and IMAP?

POP3 (ports 110/995) downloads messages to a single device and usually deletes them from the server — good for one computer. IMAP (ports 143/993) keeps messages on the server and syncs state across all devices. For using mail on several devices, choose IMAP.

Can I use one port for both sending and receiving?

No. Sending uses SMTP submission ports (587 or 465), while receiving uses IMAP (993/143) or POP3 (995/110). They are different protocols on different ports, so your client always needs at least one outgoing and one incoming port configured separately.

Sources

• RFC 6409 — Message Submission for Mail (port 587)
• RFC 8314 — Cleartext Considered Obsolete: Use of TLS for Email (implicit TLS)
• RFC 3207 — SMTP Service Extension for Secure SMTP over TLS (STARTTLS)
• IANA Service Name and Transport Protocol Port Number Registry