The four ports

The four ports compared

Three of these four ports are registered with IANA for mail and defined by an RFC. One is a provider convention with no standing at all. The distinction matters, because it decides whether a port works everywhere or only where a particular vendor decided to listen on it.

Port 25Port 587Port 465Port 2525
What it is forMail transfer between mail serversMessage submission from an application or clientMessage submission over implicit TLSA fallback submission port where a provider offers one
IANA service namesmtp, "Simple Mail Transfer"submission, "Message Submission"submissions, "Message Submission over TLS protocol", sharing the port with urdms-v-worlds, which has nothing to do with email
Defined byRFC 5321RFC 6409RFC 8314Nothing. It is a convention
EncryptionOpportunistic STARTTLS, negotiated per connectionSTARTTLS, upgrading a plaintext connectionImplicit TLS, before any SMTP commandWhatever the provider offers, usually STARTTLS
AuthenticationNone for inbound transferRequired by defaultRequired, on the same submission rulesSet by the provider, normally identical to 587
Blocked outbound?Yes, by most cloud, hosting and consumer networksNo. RFC 5068 says access providers must not block itRarelyRarely, which is the entire reason it is offered
Use it whenYou are a mail server, sending to or receiving from another mail serverAlways, unless something specific rules it outThe client only speaks implicit TLS, or a cleartext phase is unacceptable587 is blocked and your provider explicitly supports 2525
OmniveryInbound only. Mail for your domain arrives here and is routed by rulesOutbound submission at smtp.omnivery.netNot offered for submissionNot offered for submission

Sources: IANA Service Name and Transport Protocol Port Number Registry; RFC 5321, RFC 6409, RFC 8314 and RFC 5068. Omnivery values are from the SMTP and inbound routing documentation linked below.

Port 587, the submission port

Port 587 is where an application, a client or a device hands a message to a mail system for the first time. RFC 6409, Message Submission for Mail, is short and unambiguous about it:

"Port 587 is reserved for email message submission as specified in this document. Messages received on this port are defined to be submissions."

RFC 6409, section 3.1. Published November 2011, obsoleting RFC 4409.

Two things follow from that, and they are the reason 587 is the default answer rather than merely one option among several.

Submission is authenticated by default

The submission role is not just a different port number for the same protocol. It carries a different set of obligations, and the first of them is that the sender identifies itself:

"The MSA MUST, by default, issue an error response to the MAIL command if the session has not been authenticated using [SMTP-AUTH], unless it has already independently established authentication or authorization."

RFC 6409, section 4.3. The MSA is the Message Submission Agent, the server accepting the message.

This is what separates submission from transfer at the level of the standard rather than the level of the port number. A message arriving on port 25 from another mail server is anonymous by design, because the sending server has no account with the receiving one. A message arriving on port 587 belongs to somebody, and that somebody can be rate limited, filtered, held to an acceptable use policy, and identified afterward. Every operational control a sending platform applies depends on knowing whose message it is.

It is the port nobody is allowed to block

RFC 5068, which is BCP 134, is the operational counterpart to RFC 6409. It puts one hard requirement on the networks in between:

"Access Providers MUST NOT block users from accessing the external Internet using the SUBMISSION port 587."

RFC 5068, section 4.1. The same document says at section 3.1 that "MUAs SHOULD use the SUBMISSION port for message submission".

M3AAWG's current best practices go one step further than the RFC and cover both submission ports, telling providers to "allow customer hosts to connect to port 465 and 587 submission servers on your network and on other networks".

The requirement is honored in practice by the providers that block port 25 hardest. Google Cloud states that it "does not place any restrictions on traffic sent to external destination IP addresses using destination TCP ports 587 or 465". Microsoft says connections to authenticated relay services "are typically on TCP port 587 and isn't blocked", regardless of Azure subscription type. Amazon says a sender can "connect to Amazon SES using ports 465 or 587, neither of which is restricted". The three largest clouds block 25 and deliberately leave 587 open.

What to configure

Omnivery's servers at smtp.omnivery.net listen on port 587. The connection authenticates with AUTH LOGIN using an SMTP credential. Insecure connections are supported, but upgrading to TLS with STARTTLS is strongly recommended. The MAIL FROM address must be on a configured sending domain and the From header has to align with it, which is a constraint your DMARC policy already imposes.

Where the integration is yours to choose, choose the API. SMTP submission is for systems that cannot reasonably take an API client - appliances, legacy billing and notification engines, anything where the sending code is not open for change. It is not a reduced version of the platform: the relay carries full parity with the REST API through X-OV-* headers, and the SMTP relay page covers what happens to a message after submission. But if you are writing the integration from scratch, the API is the more efficient path, and it takes port configuration out of the picture entirely.

Port 465, and the deprecation that was not what people think

Port 465 carries submission over implicit TLS: the TLS handshake completes before any SMTP command is exchanged, so there is no plaintext phase at all. It is the other correct answer for submission, and the reason it is usually presented as second choice is a history that most explanations of it get wrong.

You will read that port 465 is deprecated. You will also read that it was un-deprecated. Both statements are describing the same set of events badly, and RFC 8314 tells the story itself:

"Historically, port 465 was briefly registered as the 'smtps' port. This registration made no sense, as the SMTP transport MX infrastructure has no way to specify a port, so port 25 is always used. As a result, the registration was revoked and was subsequently reassigned to a different service. In hindsight, the 'smtps' registration should have been renamed or reserved rather than revoked."

RFC 8314, section 7.3.

What was revoked was a registration for something else. "SMTPS" meant SMTP transport over TLS - server-to-server delivery - and that was a genuinely broken idea, because an MX record names a host and carries no port, so a delivering mail server has no way to be told to use 465. Nothing about submission was withdrawn, because submission was never what the registration described.

What happened next is that mail software ignored the distinction. RFC 8314 again: "some widely deployed mail software interpreted 'smtps' as 'submissions' and used that port for email submission by default when an end user requested security during account setup." A decade of clients and servers shipped implicit-TLS submission on 465 while the registry said the port belonged to a directory service.

How it was resolved

RFC 8314, Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access, was published in January 2018 on the Standards Track. Rather than assign a new port and force a migration, it registered the real-world usage:

Service Name: submissions
Transport Protocol: TCP
Description: Message Submission over TLS protocol
Reference: RFC 8314
Port Number: 465

The IANA registration made by RFC 8314, section 7.3, described in the RFC itself as "a one-time procedural exception to the rules in [RFC6335]" requiring explicit IESG approval.

The registry today shows two live entries on TCP port 465: urd, the service the port was reassigned to, and submissions. The RFC calls that "a 'wart' in the registry documenting real-world usage of a port for two purposes", and judged it the least bad of the available options.

The industry guidance followed. M3AAWG's current best practices for managing port 25, updated August 2023, open by telling providers to "Provide email submission services on ports 465 and 587 as described in RFC 6409 and the updates in RFC 8314", and go on to say that client software should be configured "to use port 465 or 587 and authentication for email submission". The two ports are named together, as alternatives of equal standing. Whatever the folklore says, the body whose members are the mailbox providers treats 465 as a current submission port.

When 465 is the better choice

RFC 8314's recommendation for the transition is that "clients and servers SHOULD implement both STARTTLS on port 587 and Implicit TLS on port 465", and the document as a whole prefers implicit TLS on the grounds that it is deployed more consistently. Two cases where it is the right call:

  • The client only speaks implicit TLS. Plenty of appliances, embedded devices and older libraries offer an "SSL" checkbox and nothing else. If the option is implicit TLS or cleartext, take implicit TLS.
  • A cleartext phase is unacceptable. STARTTLS begins in the clear and negotiates upward, which is a window an active attacker on the path can act on. Implicit TLS has no such window. Where the network between the application and the relay is not trusted, that difference is the whole argument, and it is the subject of the STARTTLS section below.

One case where it is the wrong call: the provider has to be listening on it. A registration says the port is the correct one for the job. It says nothing about whether a particular server accepts connections there, and providers differ. Microsoft states that a device recommending or defaulting to port 465 does not support the TLS versions required for client SMTP submission, so 465 will not work with Microsoft 365. Omnivery accepts submission on port 587 and does not offer 465. Confirm the port in your provider's own connection details before configuring it, because a port nobody is listening on fails exactly like a blocked one.

Port 25 is for mail servers, not for applications

Port 25 is registered with IANA as smtp, "Simple Mail Transfer", and it is the port on which one mail server hands a message to the next. When a message leaves a sending platform for Gmail, it arrives on port 25 at a host named by gmail.com's MX records. Every mail server on the internet that accepts mail accepts it there.

It is not the port an application submits on, and RFC 6409 draws the line by role rather than by port number: a site "MAY choose to use port 25 for message submission by designating some hosts to be MSAs and others to be MTAs". The port is a convention that follows the role. What makes something submission is that an identified sender is handing over a message it originated; what makes something transfer is that one server is relaying a message it received.

Why outbound port 25 is blocked

Transfer on port 25 is anonymous by necessity - a delivering server has no account with the receiving one - and for years that made a compromised desktop machine an ideal spam cannon. It could open connections directly to every recipient's mail server, with no provider in the path applying rate limits, filtering or an acceptable use policy. The industry response was to close the path.

M3AAWG published the recommendation in 2005 and has maintained it since. It is one item in a seven-part set of email transmission best practices for providers:

"Block access to port 25 from all hosts on your network other than those that you explicitly permit to operate as SMTP relays. Such hosts will certainly include your own email submission servers and may also include the legitimate email submission servers of your responsible customers."

M3AAWG Best Common Practices for Managing Port 25 for IP Networks, original recommendation published 2005, updated August 2023.

The other items in that list are the reason the recommendation is not simply "close the port". A provider blocking 25 is required by the same document to provide email submission services on ports 465 and 587, to require authentication for it, and to allow customer hosts to connect to submission servers "on your network and on other networks". Blocking transfer is only defensible alongside supplying an authenticated route out, which is what makes the blocked port an anti-abuse measure rather than a restriction on sending.

The major cloud platforms apply the same policy to their own compute, and document it:

  • Google Cloud - "Due to the risk of abuse, connections to destination TCP Port 25 are blocked when the destination is external to your VPC network." Traffic to external addresses on 587 or 465 carries no such restriction.
  • Microsoft Azure - "The Azure platform blocks outbound SMTP connections on TCP port 25 for deployed VMs", with Enterprise Agreement and MCA-E subscriptions exempted and Enterprise Dev/Test blocked by default but able to request removal.
  • Amazon Web Services - "Amazon EC2 restricts port 25 by default", removable by request, and SES notes a sender "can also connect to Amazon SES using ports 465 or 587, neither of which is restricted".

This is the single most common cause of an application that "cannot send email". The symptom is a connection that hangs and then times out rather than an error, because a dropped packet produces silence, not a refusal. Nothing is wrong with the credentials, the mail server or the code.

What the standards actually say about blocking it

Worth being precise here, because port-25 blocking is often described as though a standard mandates it. It does not. RFC 5068, the BCP on email submission operations, declines to take a position:

"This document offers no recommendation concerning the blocking of SMTP port 25 or similar practices for controlling abuse of the standard anonymous mail transfer port."

RFC 5068, section 4. The same document's only hard requirement on access providers runs the other way: they "MUST NOT block users from accessing the external Internet using the SUBMISSION port 587".

So the blocking is an operator practice, adopted very widely and recommended by M3AAWG, while the standards-level obligation is the one that keeps 587 open. That is a distinction with a practical consequence: a network blocking port 25 is behaving normally and there is no standard to appeal to, whereas a network blocking port 587 is misconfigured and can be told so.

Blocked for submission does not mean obsolete

The step most explanations skip. Outbound port 25 being blocked on your machine says nothing about port 25 as a protocol.

Every mail server on the internet still receives on port 25. The block is on your machine sending out, not on mail servers accepting in.

Blocking is applied at the edge of end-user, hosting and cloud networks. It is not applied to the mail infrastructure those networks send through, which would stop mail working entirely.

Your provider's outbound servers deliver on port 25, to hosts named by the recipient domain's MX records, because there is no other way for mail to be delivered. That is one half of what port 25 is doing. The other half is the direction almost nobody writing about SMTP ports covers, and it is next.

Receiving mail on port 25

Sending and receiving are different problems that happen to share a protocol. A sender needs 587 outbound. A domain that also accepts mail needs something listening on 25 inbound, at whichever host its MX records name. Those two requirements are met by different software, on different ports, under different rules, and a guide that only covers submission has covered half of SMTP.

The case comes up more often than it sounds. An application sending transactional mail generally also needs to catch what comes back: replies to a notification, a customer answering an order confirmation, a partner responding to an automated report. Running a mailbox server to receive them is a large amount of infrastructure for a small requirement.

How inbound routing works at Omnivery

Omnivery receives inbound mail for a configured domain and applies routes to it. A route is a rule, and the model is small enough to describe completely:

  • Match on one of three fields - mail_from, mail_to or subject - using a regular expression, so the pattern can be as broad or as specific as the case needs.
  • Forward sends a matching message on to a destination email address.
  • Stop discards a matching message. This action is final.
  • System messages are excluded from routing. Bounces, feedback loop reports and other server-to-server traffic intended for the domain are handled separately rather than matched against your rules, so a broad pattern cannot accidentally capture or discard them.

That last point is what makes a broad rule safe to write. The traffic you most need never to lose is the traffic the routing layer never sees.

Inbound routing is the piece that lets an application send transactional mail from an address that can also be replied to, without operating a mailbox server for the replies.

A reply arrives on port 25, matches a rule, and is forwarded to a real mailbox or a ticketing address. The sending application is unchanged.

Configuration is documented at domain routes. Outbound submission is documented separately at sending over SMTP.

Port 2525, the unofficial fallback

Port 2525 is not an SMTP port. It is not assigned to mail by IANA, no RFC mentions it, and there is no sense in which a mail server is expected to be listening there. The registry entry for TCP 2525 is ms-v-worlds, "MS V-Worlds", which is unrelated to email.

What it is, is a convention. Some providers listen on 2525 in addition to the registered ports, for one reason: it is a high, unremarkable port that networks blocking 25 have no reason to block. Mailgun documents its servers on ports 25, 465, 587 and 2525, and gives exactly that rationale, noting that Google Compute Engine allows 2525 for SMTP submission. Google's own Compute Engine documentation uses 2525 as its worked example when explaining how to open a custom port for mail.

Two things follow, and both are reasons to treat it as a fallback rather than a default.

  • It only works where a provider explicitly supports it. There is no standard to point at and nothing to fall back on. Where a provider does not offer 2525, nothing is listening, and a configuration using it fails in a way that looks exactly like every other connection failure.
  • The fallback port is not the same everywhere. Amazon SES offers 2465 and 2587 rather than 2525, mirroring 465 and 587 respectively. "The alternative SMTP port" is not a thing; each provider picked its own.

Reaching for 2525 is a symptom worth reading. It means something in the path is blocking a registered submission port, and that is usually the thing to fix.

Port 25 being blocked is normal and expected. Port 587 being blocked is a misconfiguration on a network that has an obligation under RFC 5068 not to do it, and it is worth raising with whoever runs that network before working around it.

Omnivery accepts submission on port 587 and does not offer 2525. Where 587 is genuinely unavailable and cannot be opened, we encourage customers to reach out to our support.

STARTTLS versus implicit TLS

This is the distinction underneath the 587-versus-465 question. The two ports differ in when encryption starts, and that difference has one security consequence.

  • STARTTLS - the connection opens in the clear. The client issues EHLO, the server advertises its extensions, and if STARTTLS is among them the client issues the command and the two negotiate TLS on the connection they already have. RFC 3207 specifies that "upon completion of the TLS handshake, the SMTP protocol is reset to the initial state", so the conversation starts again inside the encrypted channel. This is port 587.
  • Implicit TLS - the TLS handshake happens first, on connect, before a single SMTP command is exchanged. There is no cleartext phase to reset from. This is port 465.

The stripping attack

The weakness in an opportunistic upgrade is that the client learns TLS is available by being told so, over a channel that is not yet protected. RFC 3207 names it in its own security considerations:

"A man-in-the-middle attack can be launched by deleting the '250 STARTTLS' response from the server. This would cause the client not to try to start a TLS session."

RFC 3207, section 6. Published February 2002.

An attacker positioned on the path does not have to break TLS. It removes the offer, the client concludes the server does not support encryption, and the session continues in the clear with credentials and message content in it. The attack works on any client that treats TLS as desirable rather than required, which is the default behavior in a surprising amount of mail software.

The fix is a client setting, not a port

Configure the client to require TLS and to fail the send if it cannot get it. A client that requires TLS is not vulnerable to stripping, because a removed offer produces a refusal to send rather than a cleartext send. RFC 3207 leaves the choice to the client - "if the client receives the 454 response, the client must decide whether or not to continue the SMTP session" - and that decision is yours to make in configuration.

Most SMTP libraries express this as a distinction between two settings that sound similar and behave very differently: something like "use TLS if available" against "require TLS". Only the second one is a security control. Where the library offers only the first, port 465 removes the question, which is the practical case for implicit TLS.

RFC 8314 is titled Cleartext Considered Obsolete for this reason, and its recommendation for the transition period is that clients and servers support both: "clients and servers SHOULD implement both STARTTLS on port 587 and Implicit TLS on port 465".

Two different TLS decisions

One point that gets conflated. Encrypting your submission to the relay and encrypting the relay's delivery to the recipient's mail server are separate decisions on separate connections.

  • Submission - your application to smtp.omnivery.net on port 587. Omnivery supports insecure connections and strongly recommends upgrading with STARTTLS. This is the leg you control with client configuration.
  • Delivery - the relay to the recipient's mail server on port 25, where TLS is opportunistic by the nature of anonymous transfer. Omnivery exposes this as a per-message control through the X-OV-Require-TLS header, so a message that must not be delivered in the clear is not delivered in the clear.

Requiring TLS on submission does nothing about the second leg, and a great many discussions of "is email encrypted" are two people each talking about a different one of these.

Which port should you actually use?

The short version, in order of how often each applies.

  • Use 587. It is the default for anything submitting mail from an application, a client or a device. It is standards-defined for the job, authenticated by default, and the one port access providers are required not to block. Configure the client to require TLS via STARTTLS rather than to accept it if offered.
  • Use 465 when the client requires implicit TLS, or when a cleartext negotiation phase is not acceptable on the network between your application and the relay. Confirm your provider listens on it first, because several major ones do not.
  • Do not use 25 for submission. It is the transfer port. Your provider uses it to deliver your mail and your domain's mail server uses it to receive; neither of those is your application's connection to a relay.
  • Use 2525 only if 587 is blocked and your provider explicitly supports it. It is a provider convention with no standing, the specific port number varies between providers, and a blocked 587 is usually a network problem worth fixing rather than routing around.

If you are choosing a port, the answer is 587. If 587 does not work, the problem is almost never the port number.

A connection that fails on 587 is far more often blocked outbound, failing authentication or failing certificate validation than it is aimed at the wrong port number.

When the port is not the problem

Most reports of an SMTP port failure are not about the port. The port number is the most visible setting in the configuration, so it collects the blame, but the failures below account for the large majority of cases and only one of them is fixed by changing a number.

  • Outbound blocking by the host, not the mail server. The cloud and hosting policies above are applied at the network edge, so the packet never reaches the destination. The symptom is a hang and then a timeout rather than a rejection, because there is no error to return. This is the port-25 case almost every time, and occasionally a corporate network doing the same to 587.
  • Authentication failing, reported as a connection problem. A wrong credential, a credential for a different sending domain, or a client sending AUTH before the connection is encrypted where the server requires encryption first. Some clients surface all of these as "could not connect".
  • TLS negotiation failing on certificate validation. An outdated CA bundle, a system clock far enough out to make a valid certificate look expired, or a middlebox intercepting TLS and presenting its own certificate. The connection opens, the handshake fails, and the client reports a connection error.
  • Rate limits at the receiving end, seen as timeouts. A receiver deferring or throttling a sender produces slow responses and dropped connections that look like a network fault from the sending side. Volume-related, not configuration-related, and it changes with your sending rather than with your settings.
  • A firewall permitting the connection but breaking the handshake. Stateful inspection or an SMTP-aware proxy that opens the TCP connection, then interferes with EHLO or strips the STARTTLS capability. This is the same shape as the stripping attack, arriving from your own security equipment rather than an adversary.

The order to check things in

Each step below only makes sense if the one before it passed, which is what makes the order worth keeping.

  • Outbound connectivity first. From the sending host, not from your laptop, open a raw connection to the relay on the port in question. If it does not open, nothing else in this list can be the cause and the answer is with whoever runs the network.
  • Then the SMTP greeting and the extension list. A connection that opens should return a 220 banner and, after EHLO, advertise STARTTLS. If it opens but the banner is wrong or STARTTLS is absent, something is in the path.
  • Then TLS. Negotiate it explicitly and read the certificate chain. Validation failures at this step are almost always local trust store or clock issues.
  • Then authentication. Only once the channel is up. A failure here is a credential or a permission, and it will say so.
  • Then provider-side limits. If everything above succeeds and messages are still failing or slow, the constraint is on the sending or the receiving side rather than on the connection - rate limits, a sending domain limit, or a receiver deferring you. The IP and domain warming guide covers the deliverability half of that, which is where a new domain or a volume increase shows up first.

Relaying through Office 365 or Google Workspace

Both platforms accept application mail, and both do it on their own terms: their own hostnames, their own supported ports, their own authentication models and their own documented limits. Those limits, rather than the port numbers, are what usually decide whether the arrangement works.

  • Office 365 SMTP relay - Microsoft documents four different methods with four different endpoints, only one of which Microsoft itself calls "SMTP relay". Client SMTP submission uses smtp.office365.com on port 587 and requires a licensed mailbox; port 465 is not supported at all. Two of the four methods cannot reach external recipients.
  • Google Workspace SMTP relay - the relay service uses smtp-relay.gmail.com and accepts 25, 465 or 587, with 587 for TLS. Authentication is by IP allowlist, SMTP AUTH or both. There is a separate, much smaller service on smtp.gmail.com, and a third endpoint that reaches Google addresses only.

Neither platform is built to be an application sending platform, and the documented throughput limits are usually what settles it: Microsoft caps client submission at 10,000 recipients a day and 30 messages a minute, and Google allows 10,000 recipients per user per 24 hours with a hard limit of 100 recipients per SMTP transaction.

At a glance

SMTP ports at a glance

  • Port 587 is the standard port for submitting email from an application, a client or a device, using STARTTLS encryption.
  • RFC 6409 states that port 587 is reserved for email message submission and that messages received on port 587 are defined to be submissions.
  • RFC 6409 requires a message submission agent to reject the MAIL command by default when the session has not been authenticated, which makes authentication the defining property of submission rather than the port number.
  • IANA registers TCP port 587 as the service submission, "Message Submission", referencing RFC 6409.
  • RFC 5068, which is BCP 134, states that access providers must not block users from accessing the external internet using the submission port 587.
  • Port 465 uses implicit TLS, establishing encryption before any SMTP command is exchanged, so no part of the session takes place in cleartext.
  • Port 465 was briefly registered as "smtps" for SMTP transport over TLS, a registration RFC 8314 describes as making no sense because MX records cannot specify a port, and that registration was revoked and the port reassigned.
  • RFC 8314 registered the service name submissions on TCP port 465 in January 2018, describing the registration as a one-time procedural exception made to document widespread existing practice.
  • IANA currently lists two live registrations on TCP port 465: urd and submissions.
  • Port 465 was never deprecated as a submission port by any standard, because the registration that was revoked described server-to-server transfer rather than submission.
  • RFC 8314 recommends that clients and servers implement both STARTTLS on port 587 and implicit TLS on port 465.
  • Port 25 is registered with IANA as smtp, "Simple Mail Transfer", and is used for mail transfer between mail servers rather than for application submission.
  • Outbound port 25 is blocked by most consumer internet providers, hosting platforms and cloud providers as an anti-abuse measure.
  • Google Cloud blocks connections to destination TCP port 25 when the destination is external to the customer VPC network, and places no restriction on traffic to external addresses on ports 587 or 465.
  • Microsoft Azure blocks outbound SMTP connections on TCP port 25 for deployed virtual machines, exempting Enterprise Agreement and MCA-E subscriptions.
  • Amazon EC2 restricts outbound port 25 by default and requires a request to remove the restriction, while ports 465 and 587 to Amazon SES are unrestricted.
  • M3AAWG recommends that providers block access to port 25 from all hosts on their network other than those explicitly permitted to operate as SMTP relays, a recommendation first published in 2005 and updated in August 2023.
  • M3AAWG best practice is that providers offer email submission services on ports 465 and 587, citing RFC 6409 and the updates in RFC 8314, which places the two submission ports on equal footing.
  • M3AAWG also recommends that providers require authentication for email submission and allow customer hosts to connect to port 465 and 587 submission servers on their own network and on other networks.
  • RFC 5068 offers no recommendation for or against blocking port 25, so outbound port 25 blocking is an operator practice rather than a standards requirement.
  • A blocked outbound port typically produces a connection that hangs and then times out rather than an error, because a dropped packet returns no response.
  • Port 25 being blocked for outbound submission does not make port 25 obsolete, because every mail server on the internet still receives mail on it.
  • Inbound mail for a domain is delivered on port 25 to the host named by that domain's MX records.
  • Omnivery receives inbound mail on port 25 for configured domains and applies routing rules to it.
  • Omnivery inbound routing rules match on mail_from, mail_to or subject using regular expressions.
  • An Omnivery inbound route applies a forward action to a destination email address or a stop action that discards the message, and the stop action is final.
  • Omnivery inbound routing excludes system messages such as bounces and feedback loop reports, which are handled separately rather than matched against customer rules.
  • Port 2525 is not assigned to email by IANA, is not named in any RFC, and works only where a provider explicitly supports it.
  • The IANA registration for TCP port 2525 is ms-v-worlds, which is unrelated to email.
  • Mailgun documents SMTP servers on ports 25, 465, 587 and 2525, offering 2525 because networks that block other ports generally allow it.
  • Amazon SES offers ports 2465 and 2587 rather than 2525, so there is no single alternative SMTP port shared across providers.
  • STARTTLS upgrades a connection that opened in cleartext to an encrypted one, and RFC 3207 specifies that the SMTP protocol is reset to its initial state once the TLS handshake completes.
  • RFC 3207 states that a man-in-the-middle attack can be launched by deleting the 250 STARTTLS response from the server, which causes the client not to attempt a TLS session.
  • A client configured to require TLS rather than to accept opportunistic encryption is not vulnerable to STARTTLS stripping, because a removed offer causes the send to fail instead of proceeding in cleartext.
  • Encrypting submission from an application to a relay and encrypting delivery from that relay to a recipient mail server are separate decisions on separate connections.
  • Omnivery accepts SMTP submission at smtp.omnivery.net on port 587, authenticating with AUTH LOGIN.
  • Omnivery supports insecure SMTP connections but strongly recommends upgrading the connection to TLS using STARTTLS.
  • Omnivery recommends its REST API over SMTP submission wherever the integration is open to change, on the grounds that it is the more efficient path for developers.
  • Omnivery's SMTP relay carries full feature parity with its REST API through X-OV-* headers, so choosing SMTP does not reduce the available functionality.
  • Omnivery exposes per-message enforced TLS on delivery through the X-OV-Require-TLS header, which is a separate control from the encryption used on the submission connection.
  • Most reported SMTP port failures are caused by outbound network blocking, authentication errors, certificate validation failures, receiver rate limits or firewall interference rather than by an incorrect port number.
  • A useful diagnostic order for an SMTP connection failure is outbound connectivity, then the SMTP greeting and advertised extensions, then TLS negotiation, then authentication, then provider-side rate limits.
  • Microsoft documents that a device recommending or defaulting to port 465 does not support the TLS versions required for client SMTP submission to Microsoft 365.
  • The Google Workspace SMTP relay service accepts ports 25, 465 and 587, with port 587 used for TLS.

Questions

SMTP port questions

What port does SMTP use?

SMTP uses four ports in common practice, for two different jobs. Port 587 is the submission port, used by an application or client to hand a message to a mail system, and it is the one to configure unless something specific rules it out. Port 465 is the alternative submission port, using implicit TLS. Port 25 is the transfer port, used between mail servers, and is blocked for outbound submission on most networks. Port 2525 is an unofficial fallback that only works where a provider explicitly supports it.

What is the difference between port 587 and port 465?

When encryption starts. Port 587 opens in cleartext and upgrades to TLS using the STARTTLS command, so there is a brief unencrypted phase in which the client and server exchange greetings. Port 465 completes the TLS handshake on connect, before any SMTP command is sent, so nothing at all crosses the network in the clear. Both are registered with IANA for submission and both are correct. RFC 8314 recommends that clients and servers support both, and 587 is the wider default because more providers listen on it.

Should I use port 25 for sending email?

Not from an application. Port 25 is for mail transfer between mail servers, and an application submitting a message it originated is doing something different. In practice the attempt usually fails anyway, because most consumer, hosting and cloud networks block outbound port 25 as an anti-abuse measure. Use port 587.

Why is port 25 blocked?

Because transfer on port 25 is anonymous by design, which for years made a compromised machine an ideal spam source: it could connect directly to every recipient's mail server with no provider in the path applying rate limits or an acceptable use policy. M3AAWG recommends that providers block port 25 from all hosts other than those explicitly authorized to relay, and the major clouds apply the same policy to their own compute. Google Cloud blocks port 25 to destinations outside the customer VPC, Azure blocks it for deployed VMs outside Enterprise Agreement and MCA-E subscriptions, and Amazon EC2 restricts it by default. Note that no standard requires this: RFC 5068 explicitly declines to make a recommendation about blocking port 25.

If port 25 is blocked, how does email still get delivered?

Because the block is on end-user, hosting and cloud networks sending out, not on mail servers accepting in. Every mail server on the internet still receives on port 25, and your sending provider still delivers to those servers on port 25. What changed is the shape of the path: instead of your machine connecting directly to the recipient's mail server, it submits on port 587 to a provider that is authorized to relay, and that provider does the port 25 delivery.

What port is used to receive email?

Port 25. Mail for a domain is delivered to the host named by that domain's MX records, on port 25, by whichever mail server is sending it. This is a different job from retrieving mail from a mailbox, which uses IMAP or POP3 on their own ports and is not SMTP at all.

Can Omnivery receive inbound email?

Yes. Omnivery receives inbound mail on port 25 for configured domains and routes it based on rules. That is useful in the common case where an application sends transactional mail from an address people can also reply to, and running a mailbox server for those replies would be a large amount of infrastructure for a small requirement.

How do I route inbound email to a mailbox?

With a route, which is a rule matching on one of three fields - mail_from, mail_to or subject - using a regular expression. A matching message gets either a forward action, which sends it on to a destination email address, or a stop action, which discards it. The stop action is final. System messages such as bounces and feedback loop reports are excluded from routing and handled separately, so a broad pattern cannot capture them by accident. Configuration is documented at domain routes.

What is port 2525 used for?

Nothing standard. Port 2525 is not assigned to email by IANA - the registration on that port is ms-v-worlds, which is unrelated - and no RFC mentions it. Some providers listen on it as a fallback because it is a high, unremarkable port that networks blocking 25 have no reason to block. Mailgun documents it alongside 25, 465 and 587 for that reason. It works only where a provider explicitly supports it, and the chosen fallback port varies: Amazon SES offers 2465 and 2587 instead.

Is port 465 deprecated?

No, and the confusion is worth unpicking because it is repeated everywhere. Port 465 was briefly registered as "smtps", meaning SMTP transport over TLS between mail servers. RFC 8314 says that registration "made no sense, as the SMTP transport MX infrastructure has no way to specify a port", so it was revoked and the port reassigned. But mail software had already adopted 465 for implicit-TLS submission, so RFC 8314 registered the service name submissions on the same port in January 2018 to document the existing practice. What was deprecated was a registration for server-to-server transfer. Submission on 465 was never deprecated, and today it is standards-registered.

What is the difference between STARTTLS and implicit TLS?

STARTTLS upgrades a connection that already opened in cleartext: the client connects, the server advertises STARTTLS among its extensions, the client issues the command, and the two negotiate TLS on the existing connection. RFC 3207 specifies that the SMTP protocol is then reset to its initial state inside the encrypted channel. Implicit TLS establishes encryption on connect, before any SMTP command is exchanged, so there is no cleartext phase to upgrade from.

Which SMTP port is most secure?

Port 465 has a marginal structural advantage, because it has no cleartext phase for an attacker to act on. RFC 3207 documents the corresponding weakness in STARTTLS directly: "A man-in-the-middle attack can be launched by deleting the '250 STARTTLS' response from the server. This would cause the client not to try to start a TLS session." But that attack only works against a client that treats TLS as optional. A client on port 587 configured to require TLS, and to fail the send rather than continue without it, is not vulnerable to stripping. The security control is the client setting, not the port number.

What port does Omnivery use for SMTP?

Port 587, at smtp.omnivery.net, authenticating with AUTH LOGIN. Insecure connections are supported but upgrading to TLS with STARTTLS is strongly recommended. The MAIL FROM address must be on a configured sending domain and the From header has to align with it. Inbound mail is a separate path and arrives on port 25. Where the integration is open to change, the API is the better path; SMTP submission is for systems that cannot reasonably take an API client, and carries full parity with the REST API through X-OV-* headers.

Why is my SMTP connection timing out?

A timeout rather than a rejection almost always means the packets are not arriving, which points at outbound blocking on the sending network rather than at the mail server. If the port is 25, that is the expected behavior on nearly every cloud and hosting platform. Other frequent causes that present as connection problems: authentication failing and being reported by the client as a connection error, TLS negotiation failing on certificate validation, a firewall opening the TCP connection but interfering with the SMTP conversation, and receiver-side rate limiting producing slow responses and dropped connections. Check outbound connectivity first, then the greeting and advertised extensions, then TLS, then authentication, then provider-side limits.

Do I need to open port 25 on my firewall?

Outbound, no, unless the machine is a mail server delivering directly to other mail servers. An application submitting through a relay needs outbound 587 and nothing else. Inbound, only if the machine is itself receiving mail for a domain, which means it is named by that domain's MX records. Most systems that send transactional email need neither, because both directions are handled by the sending platform.

Can I send email without TLS?

Technically often yes, and it is a bad idea. Omnivery supports insecure SMTP connections but strongly recommends upgrading with STARTTLS, and an unencrypted submission puts your credentials and your message content on the network in the clear. Configure the client to require TLS rather than to use it if available, so that a failure to negotiate encryption fails the send instead of silently falling back. Note that this covers the submission leg only: TLS on delivery from the relay to the recipient's mail server is a separate decision, controlled per message through the X-OV-Require-TLS header.

Sources

Every external claim on this page traces to one of these. Where a statement describes Omnivery's own platform rather than a published standard, it is linked to the documentation instead.

  • RFC 6409, Message Submission for Mail, November 2011, obsoleting RFC 4409. The source of the statement that port 587 is reserved for email message submission and that messages received on it are defined to be submissions, of the requirement that a message submission agent reject an unauthenticated MAIL command by default, and of the note that a site may designate some hosts as submission agents on port 25.
  • RFC 8314, Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access, January 2018, Standards Track. The source of the port 465 history quoted above, of the submissions service registration and its description as a one-time procedural exception, and of the recommendation that clients and servers implement both STARTTLS on port 587 and implicit TLS on port 465.
  • RFC 3207, SMTP Service Extension for Secure SMTP over Transport Layer Security, February 2002. The source of the STARTTLS stripping attack quoted above, of the statement that the SMTP protocol is reset to its initial state after the TLS handshake, and of the point that a client receiving a 454 response must decide for itself whether to continue.
  • RFC 5068, Email Submission Operations: Access and Accountability Requirements, BCP 134, November 2007. The source of the requirement that access providers must not block the submission port 587, of the recommendation that mail clients use the submission port, and of the statement that the document offers no recommendation concerning the blocking of port 25.
  • RFC 5321, Simple Mail Transfer Protocol, the specification for mail transfer on port 25.
  • IANA Service Name and Transport Protocol Port Number Registry. The source of every service name on this page: smtp on 25, submission on 587, urd and submissions both on 465, and ms-v-worlds on 2525. Checked September 2026.
  • M3AAWG Best Common Practices for Managing Port 25 for IP Networks, original recommendation published 2005, updated August 2023. The source of the recommendation that providers block port 25 from all hosts other than those explicitly permitted to operate as SMTP relays, and of the accompanying practices in the same list: providing email submission services on ports 465 and 587 "as described in RFC 6409 and the updates in RFC 8314", requiring authentication for submission per RFC 4954, and allowing customer hosts to connect to submission servers on port 465 and 587 on the provider's own network and on other networks. Linked through m3aawg.org/Port25_IPNetworks, the reference URL the document names for itself. M3AAWG is the Messaging, Malware and Mobile Anti-Abuse Working Group, whose membership includes the major mailbox providers.
  • Google Cloud, Sending email from an instance. The source of the statement that connections to destination TCP port 25 are blocked when the destination is external to the VPC network, that no restriction is placed on external traffic using ports 587 or 465, and of the use of port 2525 as the worked example for a custom port.
  • Microsoft, Troubleshoot outbound SMTP connectivity in Azure. The source of the statement that the Azure platform blocks outbound SMTP connections on TCP port 25 for deployed virtual machines, of the Enterprise Agreement and MCA-E exemption, and of the note that connections to authenticated relay services on port 587 are not blocked.
  • Amazon Web Services, Amazon SES SMTP issues. The source of the statement that Amazon EC2 restricts port 25 by default and that ports 465 and 587 to Amazon SES are unrestricted, and of the SES port list that includes 2465 and 2587.
  • Mailgun, Sending Messages via SMTP. The source of the statement that Mailgun listens on ports 25, 465, 587 and 2525, of the rationale that Google Compute Engine allows 2525 for SMTP submission, and of which of those ports use STARTTLS rather than implicit TLS. Cited as an example of the port 2525 convention, not as a standard.
  • Microsoft, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365. The source of the statement that a device recommending or defaulting to port 465 does not support the TLS versions required for client SMTP submission.
  • Omnivery SMTP documentation. The source of every Omnivery submission detail on this page: the host smtp.omnivery.net, port 587, AUTH LOGIN, the support for insecure connections alongside the strong recommendation to upgrade with STARTTLS, and the statement that sending using APIs should always be preferred where integration allows.
  • Omnivery inbound routing documentation. The source of the inbound routing model described above: matching on mail_from, mail_to or subject with regular expressions, the forward and stop actions, the finality of stop, and the exclusion of bounces, feedback loop reports and other system-to-system messages from routing.

Port assignments and vendor policies change. The IANA registry entries and the three cloud providers' port 25 policies were checked in September 2026. Omnivery's documentation lists port 587 for submission and no other; where this page describes ports 465 and 2525 it is describing the protocol and other providers' practice rather than an Omnivery capability.

Related guides

The port is the first configuration value and the least interesting one. These cover what happens to a message after the connection is open.

  • Office 365 SMTP relay - the four Microsoft-documented methods, their endpoints and ports, and the recipient and rate limits that decide whether any of them will carry your volume.
  • Google Workspace SMTP relay - the three Google-documented endpoints, the authentication options for each, and the per-user and organization ceilings.
  • IP and domain warming - once the connection works, volume becomes the constraint, and a new sending domain is judged on a record it has not built yet.
  • Dedicated vs shared IP - which addresses your mail leaves the relay from, and why the conventional advice to buy a dedicated IP is wrong for most senders.
  • SMTP relay - what the relay does with a message after submission, and the parity between SMTP and the API through X-OV-* headers.