Definition
An email submission port is the TCP port through which a mail client submits a message to a mail server for delivery. Different ports serve different purposes in the email ecosystem, and using the correct port is essential for both functionality and security. The standard submission ports are 587 and 465, while port 25 is reserved for server-to-server relay.
How It Works
Each port has a defined role:
| Port | Purpose | Typical use |
|---|---|---|
| 25 | Server-to-server relay | Transfer between mail servers |
| 587 | Message submission with STARTTLS | Client submission, the recommended port |
| 465 | Message submission with implicit TLS | Client submission over always-encrypted connection |
| 2525 | Alternative submission port | Non-standard, used by some providers |
Port 587 is the internet standard for email submission and is almost always the correct choice for applications and email clients. Port 465 was historically assigned to a different protocol, then reclaimed for implicit TLS submission, and is now widely supported. Port 2525 is a non-standard alternative some hosts offer when other ports are blocked.
Why It Matters
Using the wrong port causes predictable failures. Attempting to submit mail on port 25 is often blocked by internet service providers specifically to prevent abuse, since port 25 is meant for server-to-server traffic, not end-user submission.
Choosing the right port also affects security:
- Port 587 with STARTTLS encrypts the connection after a plain-text greeting.
- Port 465 encrypts from the first byte, which some consider more robust.
- Both require authentication, tying sending to an accountable account.
For deliverability, authenticated submission on the correct port signals to the receiving server that the mail came from a known, accountable sender rather than an anonymous relay. This supports a healthier sender reputation and avoids the appearance of open-relay behaviour.
Example
A developer's email integration fails because it is configured to send on port 25, which the hosting provider blocks. Switching the configuration to port 587 with STARTTLS and authentication resolves the issue, and messages begin delivering normally.
Was this useful?
Related Glossary Terms
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
Frequently Asked Questions
Use port 587 with STARTTLS for most applications, or port 465 for implicit TLS if your provider recommends it. Avoid port 25 for client submission, as it is often blocked and is not intended for that purpose.
Yes. Port 465 is used for implicit TLS submission and is widely supported, though it was originally assigned to a different protocol. Port 587 remains the internet standard for submission.
Port 25 is intended for server-to-server relay, and open access to it enables spam relay abuse. Internet service providers commonly block it for consumer connections to prevent unauthorised sending.
Indirectly. Authenticated submission on the correct port signals a legitimate, accountable sender, which supports good deliverability. Using port 25 anonymously can look like relay abuse.