Use SMTP port 587 with STARTTLS for standard authenticated message submission. Use port 465 when the provider specifies implicit TLS. Port 25 is for server-to-server mail relay, not normal application submission. Port 2525 is an unofficial provider-specific fallback.
SMTP ports quick reference
| Port | Official purpose | Encryption | Use it when |
|---|---|---|---|
| 25 | SMTP relay between mail servers | Opportunistic STARTTLS may be used | You operate an MTA delivering to recipient MX servers |
| 465 | Message submission over TLS (“submissions”) | Implicit TLS starts immediately | Your provider documents port 465 |
| 587 | Authenticated message submission | STARTTLS upgrades the connection | Default choice for applications and mail clients |
| 2525 | No standard SMTP assignment | Usually STARTTLS when a provider supports it | 587 is blocked and the provider explicitly offers 2525 |
Port 465 is not deprecated: RFC 8314 registered it for implicit-TLS submission. Port 587 remains the standard submission port under RFC 6409. Correct implementations of required STARTTLS on 587 and implicit TLS on 465 provide comparable transport security.
Port 25: mail server relay
Mail transfer agents use TCP port 25 to deliver mail between domains after looking up MX records. End-user applications normally should not submit mail on port 25. Hosting providers often restrict outbound 25 to reduce abuse, and SMTP authentication may not be offered on this route.
Port 465: implicit TLS submission
On port 465, the TLS handshake occurs immediately after the TCP connection opens, before SMTP commands are exchanged. Use it when the email provider lists 465 as its secure submission endpoint. Configure the client for implicit TLS or “SSL/TLS,” not STARTTLS.
Port 587: submission with STARTTLS
RFC 6409 reserves port 587 for message submission. The client connects, receives the SMTP greeting, issues STARTTLS, validates the server certificate, and then authenticates. The client must require successful TLS rather than silently continuing in cleartext.
Port 2525: provider fallback
Port 2525 is widely offered by some SMTP providers as an alternative when 587 is blocked, but it is not an IETF-standard SMTP submission port. Use it only when the provider documents it and still require TLS and certificate validation.
Does the SMTP port affect deliverability?
No. The submission port controls how your application reaches its outgoing server; recipient systems normally do not rank a message based on whether the client used 465 or 587. Deliverability depends on authentication, domain and IP reputation, list quality, complaints, content, and sending behavior.
Python examples
Port 587 with STARTTLS
import smtplib
import ssl
context = ssl.create_default_context()
with smtplib.SMTP("smtp.example.com", 587, timeout=30) as smtp:
smtp.ehlo()
smtp.starttls(context=context)
smtp.ehlo()
smtp.login("username", "app-password")
smtp.send_message(message)Port 465 with implicit TLS
import smtplib
import ssl
context = ssl.create_default_context()
with smtplib.SMTP_SSL("smtp.example.com", 465, context=context, timeout=30) as smtp:
smtp.login("username", "app-password")
smtp.send_message(message)Troubleshooting checklist
- Copy the hostname, port, and encryption mode from the provider's documentation.
- Do not configure STARTTLS on an implicit-TLS endpoint or the reverse.
- Test DNS resolution and whether the network permits the destination port.
- Use an app password or SMTP credential rather than an interactive login password.
- Validate the certificate and require TLS 1.2 or newer.
- Read the full SMTP response before changing ports.
Standards and next steps
The authoritative references are RFC 6409 for port 587, RFC 8314 for port 465, and the IANA service registry.
For provider-specific values, use the Bulko SMTP configuration directory. To send without configuring your own server fleet, review the managed SMTP service.
