SMTP Port Numbers: 587, 465, 25, and 2525 Explained
The short answer
Use port 587 with STARTTLS. That's the right choice for almost every setup in 2026.
If 587 is blocked on your network, use 465 with SSL. If both are blocked, try 2525. Don't use port 25.
That's the entire decision. The rest of this page is why, and what to do when it still doesn't work.
What each port is for
Port 587: message submission. The modern standard. Your application connects, issues STARTTLS to upgrade the connection to encrypted, then authenticates and sends. Every serious provider supports it, and it's the port that was actually designed for an app or client submitting mail.
Port 465: implicit SSL. The connection is encrypted from the first byte, before any conversation happens. It was formally deprecated years ago, then brought back because everyone kept using it, and it works everywhere today. Functionally fine. Reach for it when 587 is unavailable.
Port 25: server-to-server relay. The original SMTP port, and not meant for your application. Mail servers still use it to talk to each other, but virtually every residential ISP and cloud host blocks outbound 25 to cut down on spam. If you're building on 25, you'll hit a wall on most networks.
Port 2525: the unofficial fallback. Not a standard, just a convention many providers offer because hosts that block 587 and 465 usually leave 2525 open. Useful escape hatch, no other advantage.
TLS vs SSL, in practice
You'll see both words in every settings dialog. The practical difference:
- STARTTLS (port 587) starts unencrypted and upgrades. The name in most clients is "TLS" or "STARTTLS".
- Implicit SSL (port 465) is encrypted before anything else happens. Usually labelled "SSL" or "SSL/TLS".
Both give you an encrypted connection. Pick the one that matches the port, and don't set 587 to "SSL" or 465 to "STARTTLS", which is a very common misconfiguration that produces a confusing connection error.
When sending fails, check the port first
Most "email cannot be sent" errors trace back to one of three things, in this order:
- A blocked port. Your host blocks outbound 587 or 25. Symptom is a connection timeout rather than an authentication error. Try 465, then 2525.
- The wrong encryption for the port. Connection resets or TLS handshake errors. Match STARTTLS to 587 and SSL to 465.
- Authentication, not the port at all. If you get an explicit auth failure, the port is fine and your credentials aren't. On Gmail and Yahoo that usually means you need an app password. On Microsoft 365 it usually means an admin has to enable SMTP AUTH.
When we're debugging a customer's sending, the first thing we ask for is two or three concrete failed sends. The error text tells you which of the three above you're in, and it saves an hour of guessing.
The bigger question behind the port
Here's the thing worth saying. If you're picking an SMTP port, you're configuring a mail path by hand: host, port, encryption, credentials, and a set of rules about what your network allows.
That's fine, and we still speak SMTP. But port selection is a symptom of a protocol designed in the early eighties for servers to relay mail to each other. A modern send goes over HTTPS to an API, where there is no port to choose, no encryption mode to mismatch, and no ISP blocking your traffic because port 25 was abused for two decades.
At Nitrosend we skipped the whole layer: you connect from your AI agent and send. If you want SMTP, it's there. But nobody should have to memorise four port numbers to send a receipt.
FAQ
What SMTP port should I use?
Port 587 with STARTTLS for nearly everything. Use 465 with SSL if 587 is blocked, and 2525 if both are blocked.
What is the difference between port 587 and 465?
587 starts as a plain connection and upgrades to encryption with STARTTLS. 465 is encrypted from the first byte with implicit SSL. Both are secure and both are widely supported.
Why is SMTP port 25 blocked?
Because it was heavily abused for spam relay. Most ISPs and cloud hosts block outbound port 25 by default, so applications should not use it.
What is SMTP port 2525?
An unofficial alternative many providers support as a fallback when 587 and 465 are blocked by a hosting provider. It has no technical advantage beyond usually being open.