EP 09: SMTP Port Comparison: 25 vs 587 vs 465

Port 25: Simple Mail Transfer Protocol

1. Port 25 is the original SMTP port, mainly used for transferring mail between mail servers, for example, transferring mail from a Gmail server to an Outlook server.
2. Important Characteristics:

• Port 25 was originally designed without encryption
• Can use STARTTLS optionally
• Often does NOT require authentication between trusted mail servers

Main Problem: Spammers abused port 25, so ISPs and cloud providers often block outbound port 25. Examples include AWS EC2, which blocks port 25 by default, and many home internet connections that block it as well.

When to Use Port 25:

• Running a real mail server
• Relaying mail between domains
• Receiving mail from internet MX servers

Port 587 — SMTP Submission

Port 587 is the official modern email submission port and is the most recommended port for sending emails today.

Main Purpose

Port 587 is used for communication between an email client or application and an SMTP server. Common real-world examples include:

• Outlook is sending an email on behalf of a user
• A web application sending OTP emails
• Backend services are sending automated notifications

Security Method

Port 587 uses STARTTLS, which works in the following sequence:

1. The connection starts as a normal, unencrypted connection
2. The client sends a STARTTLS command
3. The connection upgrades to an encrypted TLS connection

This ensures that credentials and email content are protected in transit.

Authentication

Authentication is required on port 587. Users or applications must provide a valid username and password before the server will accept any outgoing mail.

Why Port 587 Is Recommended

Port 587 is the preferred choice for modern email because it:

• Separates mail submission from mail relay
• Enforces authenticated users, preventing unauthorized access
• Reduces spam abuse significantly
• Works seamlessly with modern email providers

Port 465 — SMTPS (Implicit TLS)

Port 465 is commonly referred to as SMTPS or SMTP over SSL/TLS. While it serves a similar purpose to port 587, the way it handles encryption is fundamentally different.

Main Purpose

Like port 587, port 465 is used for communication between an email client or application and an SMTP server. It handles the same email submission use cases but with a different security approach.

Security Method

Port 465 uses Implicit TLS, which means TLS encryption begins immediately before any SMTP communication takes place.

The connection flow looks like this:

Connect → TLS Handshake → SMTP Commands

This is different from port 587, where the connection starts unencrypted and then upgrades via the STARTTLS command. With port 465, there is no STARTTLS step; the connection is encrypted from the very first byte.

Which One Should You Use?

Choosing the right SMTP port depends on your specific use case. Here is a simple breakdown to help you decide.

For Modern Applications

If you are building a modern application or service, Port 587 with STARTTLS is the recommended choice. It is widely supported, enforces authentication, and follows current email standards.

If Your Provider Requires SMTPS

Some email providers may require implicit TLS. In that case, use Port 465. Always check your provider’s documentation to confirm which port they support.

For Mail Server Relay

If you are running a mail server that needs to relay messages between domains or communicate with other mail servers, Port 25 is the appropriate choice.

A Simple Real-World Analogy

Sometimes the best way to understand a technical concept is through an everyday comparison.

• Port 25 is like a post office transferring mail between its own branches-no customer involvement, just server-to-server communication.
• Port 587 is like a customer handing mail to a clerk at the counter, where security checks happen before the mail is accepted.
• Port 465 is like a customer entering a fully secured, locked room before even speaking to the clerk; security is enforced from the very beginning.

An Easy Rule to Remember

• Port 25 — Mail servers talk directly to other mail servers.
• Port 587 — Applications and users submit mail securely using STARTTLS, where encryption is applied after the initial connection.
• Port 465 — Applications and users submit mail using immediate SSL/TLS encryption, where security is enforced from the moment the connection is made.

Final Recommendation

For most modern systems, the right port depends on your scenario:

• Web application email sending — use Port 587
• User mail clients — use Port 587 or Port 465
• SMTP relay servers — use Port 25
• Legacy SMTPS systems — use Port 465

When in doubt, start with Port 587. It is the current standard, broadly supported across all major email providers, and strikes the right balance between security and compatibility.