What is the difference between ports 465 and 587?
The correct answer to this question has been changed by the publication of RFC 8314. As a result, port 465 and 587 are both valid ports for a mail submission agent (MSA). Port 465 requires negotiation of TLS/SSL at connection setup and port 587 uses STARTTLS if one chooses to negotiate TLS. The IANA registry was updated to allow legitimate use of port 465 for this purpose. For mail relay, only port 25 is used so STARTTLS is the only way to do TLS with mail relay. It's helpful to think of mail relay and mail submission as two very different services (with many behavior differences like requiring auth, different timeouts, different message modification rules, etc.) that happen to use a similar wire protocol.
587 vs. 465
These port assignments are specified by the Internet Assigned Numbers Authority (IANA):
- Port 587: [SMTP] Message submission (SMTP-MSA), a service that accepts submission of email from email clients (MUAs). Described in RFC 6409.
- Port 465: URL Rendezvous Directory for SSM (entirely unrelated to email)
Historically, port 465 was initially planned for the SMTPS encryption and authentication “wrapper” over SMTP, but it was quickly deprecated (within months, and over 15 years ago) in favor of STARTTLS over SMTP (RFC 3207). Despite that fact, there are probably many servers that support the deprecated protocol wrapper, primarily to support older clients that implemented SMTPS. Unless you need to support such older clients, SMTPS and its use on port 465 should remain nothing more than an historical footnote.
The hopelessly confusing and imprecise term, SSL, has often been used to indicate the SMTPS wrapper and TLS to indicate the STARTTLS protocol extension.
For completeness: Port 25
- Port 25: Simple Mail Transfer (SMTP-MTA), a service that accepts submission of email from other servers (MTAs or MSAs). Described in RFC 5321.
Sources:
- IANA Service Name and Transport Protocol Port Number Registry
- “Revoking the smtps TCP port” - Email from Internet Mail Consortium director Paul Hoffman, 12 Nov 1998.
- RFC 6409 - Message Submission for Mail
- RFC 5321 - Simple Mail Transfer Protocol
- RFC 3207 - SMTP Service Extension for Secure SMTP over Transport Layer Security
- RFC 4607 - Source-Specific Multicast for IP
SMTP protocol: smtps (port 465) v. msa (port 587)
Ports 465 and 587 are intended for email client to email server communication - sending out email using SMTP protocol.
Port 465 is for smtps
SSL encryption is started automatically before any SMTP level communication.
Port 587 is for msa
It is almost like standard SMTP port.
MSA should accept email after authentication (e.g. after SMTP AUTH). It helps to stop outgoing spam when netmasters of DUL ranges can block outgoing connections to SMTP port (port 25).
SSL encryption may be started by STARTTLS command at SMTP level if server supports it and your ISP does not filter server's EHLO reply (reported 2014).
Port 25 is used by MTA to MTA communication (mail server to mail server). It may be used for client to server communication but it is not currently the most recommended. Standard SMTP port accepts email from other mail servers to its "internal" mailboxes without authentication.