SMTP ports define how your client connects to a mail server for submission or relay.
Fast answer
- Use 587 with STARTTLS for most application email submission.
- Use 465 when your provider requires implicit TLS.
- Avoid 25 for app submission unless explicitly required for server-to-server relay.
- Use 2525 only as a provider-specific fallback.
Port reference table
| Port | Typical use | Encryption model | Recommendation |
|---|---|---|---|
| 25 | Server-to-server relay | Optional/varies | Avoid for app clients |
| 465 | Message submission | Implicit TLS | Use when provider documents it |
| 587 | Message submission | STARTTLS | Best default for most apps |
| 2525 | Alternate submission | Usually STARTTLS | Fallback when 587 blocked |
Why port choice fails in production
Common failure patterns:
- Using implicit TLS settings on a STARTTLS port.
- Connecting to 25 from blocked cloud egress networks.
- Missing SMTP AUTH on submission ports.
- Mixing provider hostnames and port policies.
Troubleshooting map
| Symptom | Likely cause | First check |
|---|---|---|
| Timeout on connect | Egress or firewall block | Outbound network policy and host reachability |
| TLS handshake failure | Wrong TLS mode | Port + TLS mode pairing |
auth error | Credential/auth mismatch | Username/password and auth method |
reject | Policy or sender issue | Sender identity, domain auth, recipient policy |
Recommended port policy for teams
- Standardize on
unless provider docs require otherwise. - Keep
as explicit exception path. - Do not use
for application submission in CI or production. - Document one approved port policy per environment.
Validation checklist before release
- Confirm host + port + TLS mode match provider docs.
- Validate auth credentials in staging.
- Send a controlled test email and inspect headers.
- Verify SPF/DKIM/DMARC alignment.
- Monitor bounces and deferrals after deployment.
Helpful routes:
- SMTP authentication
- Which SMTP port should I use?
- SMTP commands and responses
- Email deliverability test
Final take
SMTP ports are simple, but misconfiguration is expensive. Treat port selection as a policy decision, not an ad-hoc per-app choice.