SMTP Ports Explained: 25, 465, 587 (Which to Use)
SMTP uses four ports in practice: port 587 is the modern default for sending authenticated email (submission with STARTTLS), port 465 carries mail over implicit TLS, port 25 handles server-to-server relay, and port 2525 is a common fallback when providers block 587. For nearly all applications and mail clients, use port 587.
The quick answer: use 587
If you are configuring an app, a mail client, or an SMTP relay to send mail, choose port 587 with STARTTLS and authentication. It is the official IANA-designated message submission port and is supported by essentially every provider. Fall back to 465 (implicit TLS) if your library or provider prefers it, and to 2525 only when a network blocks the others.
SMTP ports at a glance
| Port | Primary use | Encryption | Recommended? |
|---|---|---|---|
| 25 | Server-to-server relay (MTA to MTA) | Opportunistic STARTTLS; often plaintext | Not for client sending; frequently blocked |
| 465 | Authenticated submission over implicit TLS | Implicit TLS (encrypted from connect) | Yes, a solid alternative to 587 |
| 587 | Authenticated submission (the standard) | STARTTLS (upgrades to TLS) | Yes, the default choice |
| 2525 | Alternate submission (unofficial fallback) | STARTTLS (upgrades to TLS) | Only when 587/465 are blocked |
Port 25: the original, now mostly for relay
Port 25 is the oldest SMTP port and still moves the vast majority of mail between mail servers (MTA to MTA). The problem is that it was designed in an era without authentication, so spammers abused it heavily. As a result, most residential ISPs and many cloud providers (including AWS EC2 by default) block outbound port 25 to cut down on abuse.
- Use it for: receiving mail on your own server, and true server-to-server relaying between MTAs.
- Do not use it for: submitting mail from an app or client. Authentication on port 25 is inconsistent and outbound 25 is often blocked entirely.
Port 587: the modern submission standard
Port 587 is the message submission port defined in RFC 6409. A client connects, issues STARTTLS to upgrade the plaintext connection to an encrypted TLS channel, then authenticates with a username and password (or API credential) before sending. Because it separates submission from relay, providers can enforce authentication and rate limits without touching inbound mail flow.
This is the port you want in 95% of cases: transactional email from an app, a newsletter platform, a CRM, or a desktop mail client.
Port 465: implicit TLS from the first byte
Port 465 was deprecated years ago, then formally reinstated by RFC 8314 as the port for SMTP submission over implicit TLS. "Implicit" means the connection is encrypted the moment it opens, with no STARTTLS upgrade step. Many modern libraries and providers support it, and it is a perfectly good choice, especially where you want encryption guaranteed before any handshake data is exchanged.
The practical difference between 465 and 587 is the mechanism, not the security outcome: 465 uses implicit TLS, 587 uses STARTTLS. Both should end in an authenticated, encrypted session. Pick whichever your provider documents.
Port 2525: the fallback when others are blocked
Port 2525 is not an official SMTP port and is not defined by any RFC, but many email service providers and SMTP relays offer it because it behaves like 587 (STARTTLS submission) while slipping past networks that block the standard ports. Cloud platforms and some corporate firewalls that block 587 and 465 frequently leave 2525 open. Reach for it only as a last resort.
How to choose the right port
- Sending from an app or client? Use 587 with STARTTLS and authentication.
- Provider recommends implicit TLS? Use 465.
- 587 and 465 both blocked by your host or firewall? Try 2525.
- Running a receiving mail server or relaying between MTAs? That is port 25's job.
Ports are only half of deliverability
Choosing the right port gets your mail off the ground, but whether it lands in the inbox depends on authentication and sender reputation. Make sure SPF, DKIM, and DMARC are set correctly for your sending domain, and consider routing volume mail through a dedicated SMTP relay service that handles encryption, warm-up, and reputation for you. If you are troubleshooting placement, our guide to email deliverability covers the reputation side in depth.
Frequently asked questions
What is the difference between port 587 and 465?
Port 587 uses STARTTLS, which begins as a plaintext connection and upgrades to encryption before authentication. Port 465 uses implicit TLS, which is encrypted from the moment the connection opens. Both are secure, authenticated submission ports; choose whichever your provider recommends.
Why is port 25 blocked?
Port 25 was designed without authentication and was heavily abused by spam and malware. To limit abuse, most ISPs and cloud hosts (like AWS EC2) block outbound port 25 by default. Use port 587 or 465 for authenticated sending instead.
Which SMTP port should I use?
Use port 587 with STARTTLS for almost everything. Use 465 if your provider prefers implicit TLS, and 2525 only if your network blocks the standard ports. Reserve port 25 for server-to-server relay and receiving mail.
Is port 2525 secure?
Yes, when used with STARTTLS. Port 2525 is an unofficial fallback that behaves like port 587, upgrading to TLS encryption after connecting. Its only real difference is that it is more likely to be left open by firewalls and cloud hosts.
Want sending handled for you, with the right ports, encryption, and authentication configured automatically? Launch with IGSendMail and start delivering to the inbox.