SMTP port number

The distinction that matters is submission versus relay. Submission is an authenticated client handing over a new message, and it belongs on 587 or 465. Relay is one mail server passing a message to another, and that is port 25. Choosing a relay port for a submission job is the single most common SMTP misconfiguration.

Common SMTP Ports and Uses

Ports 587 and 465 both carry authenticated submission over TLS and differ only in when encryption starts. Server-to-server relay runs on port 25, which most consumer and cloud networks block outbound. Some providers also accept 2525, an unofficial alternative with no protocol difference, for networks that block 587.

Port 587

Port 587 is the default port for authenticated mail submission, defined as the submission port in RFC 6409. It uses STARTTLS, which opens as plaintext and upgrades the connection to TLS via the STARTTLS command before authentication. A correctly configured server on 587 requires that upgrade and refuses to accept credentials over an unencrypted connection.

This is the port to choose unless something specific rules it out. Mail clients default to it, providers document it first, and networks that block port 25 generally leave it open.

Port 465

Port 465 uses implicit TLS: the connection is encrypted from the first byte, with no plaintext phase and no upgrade command. It was deprecated in the late 1990s, then formally reinstated for message submission in RFC 8314, which recommends implicit TLS over STARTTLS for new deployments.

Functionally the outcome matches 587. The difference is that the encryption cannot be skipped, because there is no unencrypted state to skip it from.

Port 25

Port 25 is the original SMTP port and it remains the standard for server-to-server relay, which is how mail moves between mail servers across the internet. It is not intended for authenticated client submission, and most internet service providers, cloud hosts and office networks block outbound traffic on it.

The blocking is deliberate anti-abuse policy rather than a limitation. An unauthenticated open port that accepts mail for anywhere is the exact shape of an open relay, and compromised machines used it to send spam at scale.

Port 2525

Port 2525 is not assigned to SMTP by IANA and carries no protocol difference. Several email providers listen on it as a fallback for networks that block 587, and it behaves as an alternative submission port with the same authentication and TLS expectations.

It is a workaround for a blocked network, and it works only where the receiving provider has chosen to support it.

Every port on this page is a workaround for something else: a blocked network, an old default, a relay rule written before application mail existed. The actual fix for most people reading this is not picking the right port number, it is not touching a port at all. Describe the email to Claude, ChatGPT, Cursor or Codex and Nitrosend's MCP server sends it, so the four numbers above stay reference material instead of something you configure by hand.

Go deeper