SMTP ports: which one to use, and why

If a guide, plugin or dashboard asks for an "SMTP port" and you're configuring an app to send through a provider, it almost always wants 587. Check your provider's settings page for the exact host, port and encryption it supports, then match the encryption setting to the port (see the client settings below).

Port 25 is the original SMTP port and still the only one mail servers use to deliver to each other. When Gmail receives mail for a gmail.com address, the sending server looks up gmail.com's MX record and connects on port 25; MX records have no way to name another port. So port 25 isn't going away, but it's for mail servers, not for apps.

Encryption on port 25 is opportunistic: the receiving server offers STARTTLS and the sender uses it if it can. Port 25 also doesn't expect a login, which is exactly why it attracts abuse from compromised machines and is blocked on most cloud and residential networks.

RFC 6409 split "submitting" a message (your app handing it to a provider) from "relaying" it (provider to recipient), and reserved port 587 for submission. A submission server expects the client to log in before it accepts mail.

The connection starts in plain text. The server lists its capabilities, including STARTTLS; the client sends STARTTLS, both sides negotiate TLS, and the login and message travel inside the encrypted session. A well-configured server won't accept a password before the upgrade.

On port 465, the TLS handshake happens as soon as the TCP connection opens, before any SMTP is spoken. Port 465 was briefly registered as "smtps" long ago and then revoked, which is why older guides call it deprecated. RFC 8314 (2018) registered it again as "submissions", for message submission over TLS, so it's a current standard.

RFC 8314 recommends implicit TLS for submission, asks clients and servers to support both 587 with STARTTLS and 465 during a transition, and notes there's no significant security difference between the two when both sides require TLS before sending.

Port 2525 isn't assigned to SMTP by any standard; IANA lists it for an unrelated service. Several email providers listen on it anyway, with the same STARTTLS behavior as 587, because networks that block mail ports rarely think to block 2525. Use it only when your provider documents it and the standard ports are blocked.

Port 25 needs no login, so a compromised or rented server can use it to deliver spam straight to anyone's mail server. Cloud providers block outbound port 25 to keep their IP ranges off blocklists, and many residential ISPs do the same. Some go further and block the submission ports too. Here is what the major clouds document:

Even where port 25 is open, sending straight to Gmail or Outlook from a cloud server rarely delivers well: the IP has no sending reputation, and you'd run the queue, retries and bounce handling yourself. Send through an SMTP relay on 587 or 465, or through an email API over HTTPS, and let the provider handle port 25.

Groundmail's SMTP relay listens on port 587 with STARTTLS. It doesn't listen on 465 or 2525, so a client pointed at those ports times out. The relay refuses a login before STARTTLS, so passwords never cross the network in plain text. Check it, and your credential, with the SMTP tester.

If your host blocks 587 too, as DigitalOcean does by default, send with the Groundmail API instead: it's a single HTTPS request on port 443, with the same domains, suppressions and webhooks as the relay.

Clients name the TLS options differently. For port 587, pick the STARTTLS option; for 465, pick the implicit TLS one.

For a quick check from the internet, the free SMTP tester connects to your server, upgrades to TLS, checks the certificate and tries your login, showing every reply. To test the path your app takes, run the commands below from the machine that will send the mail: a port that's open from your laptop can still be blocked from your server.

Once the connection works, delivery errors come back as bounce codes from the recipient's server, such as 550 5.7.26 for failed authentication or 550 5.1.1 for an address that doesn't exist. The SMTP error codes reference explains each one.