Definition
SMTP ports are the TCP port numbers used by the Simple Mail Transfer Protocol to route email between servers and from clients to servers. Four main ports are relevant to email delivery: port 25 is the traditional SMTP port used for server-to-server relay, port 465 was registered for SMTPS (SMTP over SSL), port 587 is the standard mail submission port defined in RFC 6409 for authenticated client-to-server submission, and port 2525 is an unofficial alternative submission port supported by many email service providers.
Port 25 is the oldest and most universally supported SMTP port, but it is increasingly blocked by internet service providers and cloud hosting providers to prevent spam. Residential ISPs and cloud platforms frequently block outbound port 25 to stop compromised machines from sending spam directly. Port 587 with STARTTLS is the recommended port for email clients and applications to submit outgoing messages, as it requires authentication and supports encryption. Port 465, though deprecated by the IANA, remains in widespread use because many email clients and libraries never fully transitioned away from it. Port 2525 provides a fallback option when port 587 is blocked by restrictive networks.
Best Practices
Always use port 587 with STARTTLS for email submission from applications and email clients. Port 587 is the standards-compliant submission port that requires authentication, and it is the most likely to be unblocked on corporate and residential networks. It is supported by virtually all email service providers.
Do not rely on port 25 for outbound email submission from your applications. Many cloud platforms including AWS, Google Cloud, and Azure block outbound port 25 by default. Use port 587 or port 2525 instead. Reserve port 25 exclusively for receiving inbound email from other mail servers.
Configure your email sending application with a fallback port order. Start with port 587, fall back to port 2525 if port 587 is unavailable, and use port 465 only if the other two are blocked. This maximises delivery success across diverse network environments.
Use TLS or SSL encryption regardless of the port you choose. Unencrypted SMTP sends credentials and message content in plain text. Port 587 typically uses STARTTLS, port 465 uses implicit TLS, and port 2525 typically uses STARTTLS. All three support encryption; you must enforce it.
Check with your email service provider for their supported ports and TLS requirements. Some providers support only specific ports, and some have deprecated port 465 or port 25 entirely. Configuring the wrong port will result in connection failures.
Related Glossary Terms
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
Email Bandwidth
Email sending bandwidth and throughput refer to the rate at which emails can be delivered, typically 100-500 emails/second per IP. Bandwidth planning ensures campaigns complete within desired delivery windows.
Email BIMI VMC
BIMI Verified Mark Certificate (VMC) certifies brand logo ownership for display in supporting email clients. VMCs cost £1,500-2,000+ per year per logo and require DMARC reject or quarantine policy plus SVG logo format.
Email Blacklist
An email blacklist (DNSBL) is a real-time database of IP addresses or domains known for sending spam or unwanted email.
Email Bulkhead
Email bulkhead pattern isolates transactional emails from marketing sends using separate IPs, subdomains, and servers. This protects critical deliverability and prevents marketing issues from affecting essential transactional messages.
Email DANE
DANE (DNS-based Authentication of Named Entities) uses TLSA records to authenticate STARTTLS connections for SMTP, preventing TLS downgrade and man-in-the-middle attacks. It requires DNSSEC to function securely.
Frequently Asked Questions
Port 25 is frequently blocked because it is the standard port for server-to-server SMTP relay, which has historically been abused by spammers sending email directly from compromised machines. Blocking outbound port 25 forces users to route email through authenticated submission servers (port 587), which can enforce sending policies and rate limits.
Port 587 uses STARTTLS, where the connection starts as plain text and is upgraded to TLS via the STARTTLS command. Port 465 uses implicit TLS, where the connection is encrypted from the start. Port 587 is the IANA-registered submission port and is the recommended standard. Port 465 was deprecated but remains widely used.
Technically yes, but it is not recommended. Port 25 is intended for server-to-server relay, not authenticated client submission. Many providers disable authentication on port 25, and many networks block outbound port 25. Port 587 is the correct port for submission and supports authentication natively.
Port 2525 is not an official IANA-registered SMTP port. It is used by some email service providers as an alternative submission port when port 587 is blocked by restrictive networks. It behaves identically to port 587 with STARTTLS and authentication. Not all providers support port 2525.
The port number itself does not affect whether a message is delivered or lands in the inbox, as long as the connection is successful and properly authenticated. However, the choice of port affects connection success rate across different networks, which indirectly affects deliverability by ensuring your message actually reaches the receiving server.