SMTP Ports Explained: 587 vs 465 vs 25

Email uses a small set of port numbers, and mail apps ask for them every time you add an account. The ones that matter for sending are 587, 465 and 25; for receiving, 993 (IMAP) and 995 (POP3). Each port expects a particular kind of encryption, and choosing a port without its matching setting is the most common reason an account receives mail but can't send it.

Short answer: in a mail app, use 587 with STARTTLS or 465 with SSL/TLS, whichever your provider lists first. Port 25 is for servers relaying mail to each other, not for your app. For incoming mail, use 993 for IMAP or 995 for POP3, both with SSL/TLS.

Looking for a specific provider's server names? See the SMTP server settings for every provider, or enter any address in the Email Settings Finder.

Email ports at a glance

The standard for email encryption asks providers to phase out unencrypted access "as soon as practicable" (RFC 8314), so 143 and 110 without encryption are on their way out. Use 993 and 995 whenever the provider lists them.

Port 587: submission with STARTTLS

Port 587 is reserved for message submission: the step where your mail app hands a new message to your provider (RFC 6409). The connection opens unencrypted and the app then issues a STARTTLS command, which upgrades it to an encrypted TLS session before your username and password are sent.

The submission standard also requires the server to refuse to send mail for a session that hasn't signed in (RFC 6409, section 4.3). That's why "outgoing server requires authentication" has to be switched on in your app. Without it, the server answers with an "authentication required" error and nothing leaves the outbox.

Some apps label this setting "TLS" rather than "STARTTLS". On port 587 they mean the same thing.

Port 465: submission over implicit TLS

Port 465 does the same job as 587, but the connection is encrypted from the first byte. There is no unencrypted greeting and no upgrade step; the TLS handshake starts the moment the app connects. The standard calls this implicit TLS, and mail apps usually label it "SSL/TLS" or just "SSL".

Is port 465 deprecated?

No, though it once looked that way, and older articles still say so. Port 465 was briefly registered for SMTP over SSL ("smtps"). That registration was revoked and the port was reassigned to a different service. Widely used mail software kept using 465 for encrypted submission anyway (RFC 8314, section 7.3).

In 2018, RFC 8314 made that practice official. It registered port 465 as "submissions" (message submission over TLS) and recommended that providers advertise implicit TLS in preference to STARTTLS. Port 465 is a current, standard submission port.

Port 25: server-to-server relay

Port 25 is the original SMTP port. Today it carries mail between servers: when your provider delivers a message to the recipient's provider, that hop uses port 25. The submission standard keeps relay on port 25 and moves mail apps to 587 (RFC 6409).

Don't use port 25 in a normal mail app. It only belongs in your settings where a provider documents it for a specific purpose, for example:

• Microsoft 365 direct send and SMTP relay for printers and line-of-business apps use port 25. Signed-in sending from an app or device (SMTP AUTH) uses smtp.office365.com on 587. See Microsoft 365 SMTP settings.
• Google Workspace SMTP relay (smtp-relay.gmail.com) accepts ports 25, 465 and 587, and is set up by the Workspace administrator.

587 vs 465: which is better?

For security, neither. RFC 8314 says there is "no significant difference" between STARTTLS on 587 and implicit TLS on 465, as long as both are implemented correctly and encryption is required. The same document asks clients and servers to support both during a transition period of several years, while advertising implicit TLS (465) first.

In practice, use the port your provider lists first, and only switch if it won't connect on your network. When you switch, change the encryption setting with it. Providers differ:

The full list, with usernames and password requirements for 15 providers, is in the SMTP server settings guide.

Match the port to the encryption

A port and its encryption setting are a pair. Mail apps name the settings differently, but there are only two combinations that work for sending:

If they're mismatched, the connection fails even though the server name is correct:

• 465 with STARTTLS: the server waits for a TLS handshake while the app waits for a plain-text greeting. Usually the result is a timeout.
• 587 with SSL/TLS: the app starts a TLS handshake that the server isn't expecting yet. Usually the result is an immediate SSL or handshake error. OpenSSL-based apps often report it as "wrong version number".

TLS versions

Encryption on any of these ports must use a modern version of TLS. The email standard now sets TLS 1.2 as the minimum for submission and mail access (RFC 8314, updated by RFC 8997, which deprecated TLS 1.1). Microsoft 365 requires TLS 1.2 or 1.3, and GMX accepts only TLS 1.2 and 1.3. An old printer, scanner or app that can't negotiate TLS 1.2 won't connect on any port. Check for a firmware or app update, or use a relay service documented for older devices.

How to test an SMTP port

If settings look right but nothing connects, check whether your network can reach the port at all.

Windows (PowerShell):

Test-NetConnection -ComputerName smtp.gmail.com -Port 587

TcpTestSucceeded : True means the port is reachable from your network. This only tests the connection, not the encryption or your password.

macOS or Linux (Terminal), port 465:

openssl s_client -connect smtp.gmail.com:465 -crlf

Port 587 with STARTTLS:

openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf

A working connection prints the server's certificate and then a line beginning with 220 or 250. Type QUIT and press Enter to close it. Replace smtp.gmail.com with your provider's server.

If the test fails on one port, try the provider's other documented port. If both fail on one network but work on another (mobile data, for example), the network is filtering outgoing mail connections. Ask that network's administrator, or use the other network.

Fixing common port errors

• Connection times out: check the port and encryption pair first. Then test the port as shown above. Many networks restrict outgoing mail traffic, especially on port 25.
• SSL, TLS or handshake error: the encryption setting doesn't match the port, or the device can't do TLS 1.2. Re-pair them as in the table above.
• "Must issue a STARTTLS command first": you're on 587 with encryption off. Set it to STARTTLS.
• "Authentication required" or "530": turn on authentication for the outgoing server and enter the full email address as the username.
• Password rejected on the right port: the port is fine. Most providers now need an app password or the app's built-in Google or Microsoft sign-in. See why the SMTP password is refused.