587 vs 465: Which SMTP Port Should You Use?

"Which SMTP port?" sounds like it should have one right answer, and the internet is full of confident, contradictory ones. The truth is calmer: for sending mail from an application, 587 and 465 are both correct and both secure — they just start encryption differently. The choice rarely affects deliverability at all. What does matter is not accidentally reaching for port 25, and understanding the one real distinction so you can configure clients without cargo-culting.

587 and 465 both encrypt your mail. The only real question is whether TLS starts after a greeting (587) or before one (465).

The one distinction that matters#

Both ports carry authenticated, encrypted message submission. They differ in when the TLS handshake happens.

• Port 587 — STARTTLS (explicit TLS). The connection opens in plaintext, the client and server exchange a greeting, and the client issues the STARTTLS command to upgrade the connection to TLS before sending credentials or the message. This is the standard submission port and the most widely supported default.
• Port 465 — implicit TLS (SMTPS). TLS is negotiated immediately on connect, before any SMTP commands. There's no plaintext phase and no upgrade step — the socket is encrypted from the first byte.

That's the whole difference. Once the handshake completes, both carry the same authenticated SMTP conversation over the same encryption. Neither is "more secure" in normal use — a correctly configured 587/STARTTLS connection and a 465 implicit-TLS connection both protect your credentials and message in transit.

A short, useful history#

Port 465 has an odd past worth knowing, because it explains the contradictory advice online. It was originally registered for SMTPS, then deprecated in favour of the STARTTLS-on-587 model, which is why for years "use 587, not 465" was the standard guidance. But implicit TLS came back into favour — RFC 8314 (2018) explicitly recommends implicit TLS for message submission and re-blessed 465 for that purpose. So both the old "prefer 587" advice and the newer "465 is fine, even preferred" advice are floating around, and both were correct at the time they were written. Today: use whichever your stack handles cleanly; both are legitimate.

Why not port 25?#

Port 25 is the classic SMTP port — for server-to-server relay (one mail server handing off to another), not for an application submitting mail. Using it for app submission is the common beginner mistake, and it fails in practice because:

• It's widely blocked. Cloud providers and ISPs routinely block outbound port 25 to fight spam, so your app often can't even open the connection.
• It's not the submission port. Submission (authenticated, from a client) is standardised on 587 (and 465). Port 25 is for MTA-to-MTA transfer.
• It invites plaintext. Historically 25 carried unencrypted mail, which is exactly what you don't want for credentials.

If a tutorial tells you to send your application's mail over port 25, that's a red flag. Use 587 or 465.

The decision, in one table#

The practical rule: default to 587; switch to 465 if your library or network makes it easier. Both land in the same place.

Hands-on: configure both#

Port 587 (STARTTLS) — Python, showing the explicit upgrade:

import smtplib
from email.message import EmailMessage

msg = EmailMessage()
msg["From"], msg["To"] = "[email protected]", "[email protected]"
msg["Subject"] = "Hello"
msg.set_content("Sent over 587 with STARTTLS.")

with smtplib.SMTP("smtp.notifiva.com", 587) as s:
    s.starttls()                    # upgrade to TLS before auth
    s.login("your_smtp_username", "your_smtp_password")
    s.send_message(msg)

Port 465 (implicit TLS) — note SMTP_SSL, TLS from the first byte, no starttls():

import smtplib
from email.message import EmailMessage

msg = EmailMessage()
msg["From"], msg["To"] = "[email protected]", "[email protected]"
msg["Subject"] = "Hello"
msg.set_content("Sent over 465 with implicit TLS.")

with smtplib.SMTP_SSL("smtp.notifiva.com", 465) as s:  # TLS on connect
    s.login("your_smtp_username", "your_smtp_password")
    s.send_message(msg)

The only code differences are the port and whether you call starttls() (587) or connect with implicit TLS from the start (465). In most frameworks you don't touch code at all — you set the port and a "TLS" vs "SSL/implicit" flag in mailer config.

Example scenario: the "port 25 doesn't work" ticket#

(Illustrative scenario, not a customer case.) A team deploys to a cloud host and wires their mailer to port 25, following an old tutorial. In development on a laptop it worked; in production, every send hangs and times out. Hours go into "the email provider is down." The provider is fine — the cloud host blocks outbound port 25, as most do. Switching the mailer to port 587 with STARTTLS (or 465) fixes it instantly. The lesson costs an afternoon: 25 is for server-to-server relay, and app submission belongs on 587 or 465.