{"id":126,"date":"2026-10-08T09:01:24","date_gmt":"2026-10-08T06:01:24","guid":{"rendered":"https:\/\/mx1mail.com\/blog\/smtp-submission-port-587-vs-465\/"},"modified":"2026-10-08T09:01:24","modified_gmt":"2026-10-08T06:01:24","slug":"smtp-submission-port-587-vs-465","status":"publish","type":"post","link":"https:\/\/mx1mail.com\/blog\/en\/smtp-submission-port-587-vs-465\/","title":{"rendered":"What Is SMTP Submission? Port 587 vs 465 Explained and How to Configure Them Correctly"},"content":{"rendered":"<h2>What does \u201cSMTP submission\u201d mean?<\/h2>\n<p>In business email, \u201cSMTP\u201d often gets used to describe two different flows: server-to-server mail delivery and user-to-server message submission. SMTP submission is the second one: a user or application (Outlook, a mobile phone, a CRM, a website form, a printer, or an integration script) authenticates to an SMTP service to send email. This is a critical distinction because submission traffic comes with stricter expectations around authentication, encryption, and abuse prevention.<\/p>\n<p>Many \u201ccan\u2019t send email\u201d tickets, and a surprising number of deliverability incidents, start with a simple mismatch: the wrong port, the wrong encryption mode, or an SMTP service that is not being used as intended. Understanding ports 587 and 465 helps IT teams standardize configuration, reduce support load, and keep outbound mail aligned with security best practices.<\/p>\n<h2>Port 587 vs port 465: what\u2019s the real difference?<\/h2>\n<p>Port 587 is the widely recommended standard for SMTP submission. Connections typically start unencrypted and then switch to encryption using the STARTTLS command. Port 465 uses a different approach: implicit TLS, where the connection is encrypted from the very first packet. Both can provide encrypted submission, but they behave differently and require different client settings.<\/p>\n<h3>Port 587 (Submission with STARTTLS)<\/h3>\n<ul>\n<li><strong>Primary purpose:<\/strong> Authenticated client-to-server email sending (submission).<\/li>\n<li><strong>Encryption model:<\/strong> Plain connection first, then upgraded to TLS via STARTTLS.<\/li>\n<li><strong>Why it\u2019s popular:<\/strong> It\u2019s the expected submission standard in many environments and is broadly supported.<\/li>\n<li><strong>Common pitfall:<\/strong> If a client isn\u2019t set to use STARTTLS\/TLS, the server may refuse the connection or the session may be downgraded in insecure environments.<\/li>\n<\/ul>\n<h3>Port 465 (SMTPS with implicit TLS)<\/h3>\n<ul>\n<li><strong>Primary purpose:<\/strong> Encrypted client-to-server sending (commonly used for submission in practice).<\/li>\n<li><strong>Encryption model:<\/strong> TLS is active immediately on connect (implicit SSL\/TLS).<\/li>\n<li><strong>Why it\u2019s useful:<\/strong> It can be simpler in environments where STARTTLS negotiation is unreliable or blocked.<\/li>\n<li><strong>Common pitfall:<\/strong> If the client is set to STARTTLS on port 465, it often fails because encryption must be implicit from the start.<\/li>\n<\/ul>\n<h2>Why choosing the right port matters for companies<\/h2>\n<p>Using the wrong port or encryption mode doesn\u2019t just cause a one-off error message. In real organizations, it leads to productivity workarounds and governance issues. When employees can\u2019t send mail reliably from their preferred client, they may fall back to personal accounts or unmanaged tools, creating visibility and data handling risks.<\/p>\n<p>Misconfiguration can also contribute to more serious security outcomes. For example, confusion around \u201cSMTP ports\u201d sometimes results in overly permissive server settings. If authentication requirements are weakened or relaying rules are misapplied, you risk creating an open relay scenario that can be abused for spam\u2014damaging IP and domain reputation and making legitimate mail harder to deliver.<\/p>\n<h2>When should you use 587, and when should you use 465?<\/h2>\n<p>As a general rule, standardize on port 587 for business email clients and application submissions. It aligns well with modern mail client expectations and administrative policies. Keep port 465 as an alternative for specific compatibility cases where implicit TLS performs more reliably.<\/p>\n<h3>Prefer 587 (recommended default)<\/h3>\n<ul>\n<li>You manage modern email clients (Outlook, Apple Mail, Thunderbird) and mobile devices<\/li>\n<li>You want one consistent internal standard that is easy to document and support<\/li>\n<li>You want to enforce authenticated sending with TLS as part of your baseline controls<\/li>\n<li>You expect STARTTLS to work reliably on the networks your users connect from<\/li>\n<\/ul>\n<h3>Consider 465 (compatibility option)<\/h3>\n<ul>\n<li>A device or application fails STARTTLS consistently but supports implicit SSL\/TLS<\/li>\n<li>Some networks interfere with STARTTLS negotiation and cause intermittent failures<\/li>\n<li>You support older clients or embedded systems that implement implicit TLS more predictably<\/li>\n<\/ul>\n<h2>The most common misconfigurations (and what they cause)<\/h2>\n<h3>1) Selecting the wrong encryption setting<\/h3>\n<p>This is the #1 cause of SMTP setup failures. On port 587, the correct choice is typically STARTTLS (sometimes labeled \u201cTLS\u201d or \u201cSTARTTLS\u201d). On port 465, the correct choice is usually \u201cSSL\/TLS\u201d (implicit). Swapping these settings can lead to immediate connection failures, repeated password prompts, or confusing \u201cserver not responding\u201d errors.<\/p>\n<h3>2) Not enabling SMTP authentication<\/h3>\n<p>Submission is expected to be authenticated. If the client isn\u2019t configured to authenticate (\u201cMy outgoing server requires authentication\u201d), the server may reject the message. Even when sending appears to work in limited cases, unauthenticated sending is a red flag operationally and can indicate an overly permissive configuration.<\/p>\n<h3>3) Mismatch between the login identity and the From address<\/h3>\n<p>Many systems enforce rules that tie the sender address to the authenticated account (or to explicitly permitted aliases). If a user tries to send as a different address without proper authorization, messages may be rejected or flagged. This is often misdiagnosed as a \u201cport problem\u201d when it\u2019s actually a policy or identity alignment issue.<\/p>\n<h3>4) Firewall and network egress rules that don\u2019t match your standard<\/h3>\n<p>Organizations sometimes allow only one outbound SMTP submission port. If your documentation says 587 but a corporate firewall blocks it (or a hotel\/ISP network blocks it), users will experience failures and seek ad-hoc solutions. IT teams should decide which ports are supported and ensure that decision is reflected in network policy and user documentation.<\/p>\n<h2>A practical checklist for correct SMTP submission setup<\/h2>\n<p>Use this checklist to validate configuration regardless of the email client or application:<\/p>\n<ol>\n<li><strong>SMTP server hostname:<\/strong> Use the hostname provided by your email service (often a mail host under your domain or a provider-supplied server name).<\/li>\n<li><strong>Port:<\/strong> Default to 587; use 465 only when needed for compatibility.<\/li>\n<li><strong>Encryption:<\/strong> 587 with STARTTLS; 465 with SSL\/TLS (implicit).<\/li>\n<li><strong>Authentication:<\/strong> Must be enabled. The username is often the full email address.<\/li>\n<li><strong>Password:<\/strong> Confirm it is current and updated on all devices after any password change.<\/li>\n<li><strong>Sender identity:<\/strong> Ensure the From address is one the user is allowed to use (primary mailbox or approved alias).<\/li>\n<li><strong>Test delivery:<\/strong> Send a test message to an external recipient and watch for delays or bounce errors.<\/li>\n<\/ol>\n<h2>Port choice is not a deliverability \u201chack\u201d<\/h2>\n<p>It\u2019s important to set expectations: choosing 587 or 465 won\u2019t magically move emails from spam to inbox. Deliverability depends on authentication (SPF\/DKIM\/DMARC), domain and IP reputation, content patterns, sending volume consistency, and recipient engagement signals. What correct submission setup does provide is a reliable, encrypted, authenticated sending path\u2014which is foundational for everything else.<\/p>\n<h2>Special notes for devices and applications<\/h2>\n<h3>Multi-function printers and legacy devices<\/h3>\n<p>Printers and older embedded devices sometimes lack STARTTLS support. If they support implicit TLS, port 465 may be the simplest secure path. If a device supports no encryption at all, treat it as a design and risk-management problem, not just a settings issue. In many environments, the safer approach is to route mail through a controlled internal relay or service that can enforce authentication and TLS, rather than letting the device send directly to the internet.<\/p>\n<h3>Websites, apps, and integrations<\/h3>\n<p>Application servers and website forms should also use authenticated submission with TLS. When troubleshooting, application logs are your best friend. Errors like \u201cTLS handshake failed,\u201d \u201cauthentication failed,\u201d or \u201cmust issue STARTTLS first\u201d typically point to a port\/encryption mismatch rather than a broader email outage.<\/p>\n<h2>Conclusion: standardize, document, and test regularly<\/h2>\n<p>Small configuration details in outbound email settings can create outsized operational pain. The most resilient approach is to standardize on port 587 with STARTTLS for day-to-day submission, define port 465 as a documented fallback, require authentication, and run periodic send tests\u2014especially after network changes or client rollouts.<\/p>\n<p>If you are migrating to a professional business email platform like MX1Mail or cleaning up existing email administration practices, updating internal setup guides around SMTP submission ports and encryption modes will reduce helpdesk volume, improve consistency across devices, and support a more secure outbound email posture.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn what SMTP submission is, the real differences between ports 587 and 465, how STARTTLS vs implicit TLS works, and how to avoid common sending misconfigurations.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[217],"tags":[298,226,231],"class_list":["post-126","post","type-post","status-publish","format-standard","hentry","category-email-infrastructure","tag-email-client-configuration","tag-smtp","tag-tls"],"_links":{"self":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/comments?post=126"}],"version-history":[{"count":0,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/126\/revisions"}],"wp:attachment":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/media?parent=126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/categories?post=126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/tags?post=126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}