Ports 465 and 587 are both for sending mail with encryption; the only difference is when TLS starts. On 465 the connection is encrypted from the first byte (implicit TLS, usually labeled "SSL" in apps), while on 587 it starts in plain text and is upgraded with the STARTTLS command ("TLS"). Use 587 when your app supports STARTTLS, 465 when it only offers SSL, and 2525 when your host blocks both.
SMTP ports at a glance
| Port | Encryption | App label | Used for |
|---|---|---|---|
| 25 | Usually none or STARTTLS | None / STARTTLS | Server-to-server relay, often blocked by hosts |
| 465 | TLS from the first byte (implicit TLS) | SSL, SSL/TLS | Message submission from clients and apps |
| 587 | STARTTLS | TLS, STARTTLS | Message submission from clients and apps (standard submission port) |
| 2525 | STARTTLS (on most relays) | TLS, STARTTLS | Unofficial fallback when other ports are blocked |
STARTTLS vs implicit TLS
Implicit TLS (port 465). The client connects and immediately starts a TLS handshake, the same way a browser does on HTTPS. No SMTP command is sent until the encrypted channel is up. If TLS fails, there is no connection at all.
STARTTLS (port 587). The client connects in plain text, the server advertises STARTTLS in its greeting response, the client sends STARTTLS, and the session is encrypted from then on. Credentials are sent only after that. The catch is that the client must require encryption: if it is set to fall back to plain text, an attacker on the network could strip the STARTTLS offer and force an unencrypted session.
In practice both are equally safe when encryption is explicitly required in the app. Current guidance (RFC 8314) slightly prefers implicit TLS on 465, but 587 remains the most common choice, and nearly every app and library supports both.
A bit of history: why 465 was called deprecated
Port 465 was once assigned to SMTPS, then revoked, and for years it was described as non-standard. Port 587 with STARTTLS became the standard for client submission. In 2018, RFC 8314 restored 465 as an official submission port with implicit TLS. Old advice saying "do not use 465" is out of date.
Which port to choose
- Your app offers TLS/STARTTLS or SSL. Use 587 with TLS (STARTTLS). It is the most compatible option.
- Your app only has an "SSL" or "Use SSL" checkbox. Use 465. Many older plugins and CMSs mean implicit TLS when they say SSL.
- Neither 587 nor 465 connects. Your host is probably blocking outbound mail ports. Try 2525 if your SMTP provider supports it.
- Port 25. Avoid it for app sending: it is meant for server-to-server relay and is usually blocked.
The classic mistake behind timeouts and "wrong version number" errors is a mismatched port and encryption type. With 465 plus STARTTLS, the client waits for a plain greeting while the server waits for TLS; 587 plus SSL fails the other way around. The pairs are fixed: 465 with SSL, 587 with TLS/STARTTLS.
Why hosts block port 25
Port 25 is how mail servers talk to each other, and it was also how infected machines and spammers sent spam directly. So clouds and hosts block or throttle outbound 25. Google Cloud blocks connections to external port 25 while allowing 587 and 465. Amazon EC2 throttles port 25 by default and requires a request to lift it. Some hosts also block 587 and 465, which is where 2525 helps.
Example: Bulko SMTP settings
Using Bulko SMTP Relay as the example, the same fields appear in any app:
| Field | Value |
|---|---|
| SMTP Host | smtp.bulko.io |
| Port 587 | STARTTLS (apps say "TLS") |
| Port 465 | SSL/TLS (apps say "SSL") |
| Port 2525 | STARTTLS, for hosts that block 587 and 465 |
| Port 25 | Not offered for submission |
| Authentication | Username and password (AUTH LOGIN/PLAIN), username like smtp_xxxxxxxxxxxxxxxx |
Credentials are in Dashboard under SMTP Access and are emailed right after payment. If you get an authentication error, make sure the full username was copied; see SMTP error 535 for details.
How to check whether a port is open
From the server that runs your site or app:
openssl s_client -connect smtp.bulko.io:465
openssl s_client -starttls smtp -connect smtp.bulko.io:587
openssl s_client -starttls smtp -connect smtp.bulko.io:2525If you see a certificate and the server greeting, the port is open. If the command hangs until it times out, your host or firewall is blocking outbound traffic. Try another port or contact your host.
Common port setup errors
- Connection timeout. The port is blocked by your host, the server firewall or local antivirus. Try another port and check outbound rules.
- "wrong version number" or "SSL routines". The encryption type is mismatched: SSL on 587 or STARTTLS on 465.
- Certificate name mismatch. The host field contains an IP address or a different domain. Enter the host name exactly as the provider gives it, for example
smtp.bulko.io, or certificate validation fails. - 535 Authentication failed. The port and encryption are fine, but the username or password is wrong. Copy them again from the dashboard without extra spaces.
- "Must issue a STARTTLS command first". The app is trying to log in on 587 without encryption. Turn on TLS/STARTTLS in its settings.
If mail starts sending after a port change but lands in spam, the port is no longer the issue. The port only controls the connection to the sending server; deliverability depends on SPF, DKIM, DMARC, domain reputation and content.
FAQ
Is port 465 SSL or TLS?
It is implicit TLS: the connection is encrypted immediately. Apps still call it "SSL" out of habit, although the protocol in use is TLS.
Which is more secure, 465 or 587?
Both are secure when configured correctly. On 587, make sure the app requires STARTTLS rather than falling back to plain text.
Why does port 465 time out?
Usually the outbound port is blocked by your host, or the encryption type is wrong (STARTTLS instead of SSL). Check the port and encryption pair, then try 587 or 2525.
Can I send from an app over port 25?
Technically yes if the server accepts it, but many hosts block the port and many SMTP services, Bulko included, do not accept submission on it. Use 587, 465 or 2525.
What is port 2525?
An unofficial alternative port supported by many SMTP relays, used when hosts block the standard mail ports. Bulko uses STARTTLS on 2525.
