Email uses several SMTP ports, and choosing the wrong one is the most common reason an app or mail client can’t send. The short version: servers talk to each other on 25, and your apps and mail clients submit mail on 587 (STARTTLS) or 465 (TLS). Here’s what each port is for, why port 25 is often blocked, and how to test them.

The ports

Port Name Purpose Encryption Authentication
25 SMTP (relay) Mail server → mail server delivery (MX traffic) Opportunistic STARTTLS Usually none (the receiving server accepts mail for its own domains)
587 Submission Clients and apps → their own mail server STARTTLS, required Required
465 Submissions (SMTPS) Clients and apps → their own mail server Implicit TLS (TLS from the first byte) Required
2525 Unofficial alternative Used by some email services when 587 is blocked STARTTLS Required

STARTTLS means the connection starts in plain text, then upgrades to TLS with the STARTTLS command. Implicit TLS encrypts from the start. Both are secure when the client requires encryption. Port 465 was deprecated for a while, then re-standardised in RFC 8314, which now prefers implicit TLS (465) for submission. Both 465 and 587 are fine and widely supported.

Which port should your app use?

When configuring WordPress (WP Mail SMTP), Laravel, Django, Nextcloud, a monitoring tool or your mail client, to send through your mail provider or your own mail server:

  • Port 587 with STARTTLS, or port 465 with SSL/TLS;
  • username and password (or an API key / app password);
  • the provider’s SMTP hostname (smtp.provider.com, or your mail.example.com).

Don’t use port 25 for apps. It’s meant for server-to-server delivery, often blocked by hosting providers and ISPs, and usually doesn’t accept authenticated submission.

Example (Laravel .env):

MAIL_MAILER=smtp
MAIL_HOST=smtp.example.com
MAIL_PORT=587
MAIL_ENCRYPTION=tls
[email protected]
MAIL_PASSWORD=app-password

For port 465, use MAIL_ENCRYPTION=ssl (naming varies by library: “SSL/TLS” means implicit TLS on 465, while “TLS/STARTTLS” means 587).

Why port 25 is blocked on many networks

Spam from compromised machines historically went straight out on port 25. To limit abuse, many ISPs and cloud providers block outbound port 25 by default, or on request only. Effects:

  • Apps can’t send directly to recipients’ MX servers. Use 587/465 to an authenticated relay instead.
  • Running your own mail server requires outbound 25 to deliver mail to other servers. Choose a host that allows it, with proper reverse DNS.

On VPS.DO, outbound mail and custom rDNS are available on USA VPS plans. See email VPS and PTR records.

Inbound port 25 must be open on your mail server so other servers can deliver mail to you.

Test SMTP ports

Is the port reachable?

nc -zv smtp.gmail.com 587
nc -zv smtp.gmail.com 465
nc -zv gmail-smtp-in.l.google.com 25       # outbound 25 from your server

timed out usually means a firewall (yours, or the provider’s) is blocking it. See netcat.

STARTTLS on 587 (or 25):

openssl s_client -starttls smtp -connect smtp.example.com:587 -servername smtp.example.com

Implicit TLS on 465:

openssl s_client -connect smtp.example.com:465 -servername smtp.example.com

Both show the certificate and a 220 greeting when working. Send a real test with authentication using swaks:

swaks --to [email protected] --server smtp.example.com:587 --tls \
      --auth LOGIN --auth-user [email protected] --auth-password 'app-password'

Common errors

Error Cause
Connection timed out Port blocked by a firewall or provider. Try 587/465, or check outbound rules
530 5.7.0 Must issue a STARTTLS command first The client didn’t start TLS on 587. Enable STARTTLS
wrong version number / TLS handshake errors Implicit TLS used on 587, or STARTTLS on 465. Swap the encryption setting
535 Authentication failed Wrong credentials, or the provider requires an app password or OAuth
554 Relay access denied Sending through a server without authenticating, or the wrong port

Server configuration

On your own Postfix server, enable 587 and 465 for authenticated submission (in master.cf), keep 25 for incoming mail from other servers, and never allow unauthenticated relaying. See SMTP security and Postfix and Dovecot mail server.

Quick reference

You are… Use
An app or mail client sending through your provider 587 (STARTTLS) or 465 (TLS) + auth
A mail server delivering to other domains 25 (outbound)
A mail server receiving mail 25 (inbound)
Blocked on 587 Try 465, or a provider’s 2525

Related: email deliverability and MX records.

  • Email
  • Networking
  • SMTP