Skip to main content
protocols.pageprotocols.page
465

Port 465 – SMTPS

TCP

Port 465 is SMTPS – SMTP with implicit TLS (TLS established immediately on connect, before any SMTP commands). It was originally registered for a different purpose, then used for SMTPS, then deprecated in favor of port 587 (STARTTLS), then re-assigned to SMTP with implicit TLS by RFC 8314 (2018). Most modern email clients support both 465 and 587.

Port Number

465

Protocol

TCP

Service

SMTP over TLS (implicit)

Range

IANA Registered (1024–49151)

Description

Port 465 uses implicit TLS – the TLS handshake happens before any SMTP dialogue, similar to HTTPS vs HTTP. Port 587 uses STARTTLS – starts plaintext then upgrades. RFC 8314 recommends implicit TLS (port 465) over STARTTLS for new clients because it eliminates the STARTTLS stripping attack vector. Both require authenticated submission.

Security risks

  • 1Certificate validation bypass: some email clients skip certificate verification on port 465 when users click through warnings. A self-signed or expired cert on a mail server means credentials are encrypted but not authenticated – MITM is possible. Use Let's Encrypt or a proper CA cert.
  • 2Port confusion: port 465 was briefly deprecated (revoked by IANA in 1998, reassigned in 2018). Some older documentation says 'do not use 465' – this is outdated. RFC 8314 (2018) explicitly reinstates it as the recommended submission port.

Firewall guidance

Allow inbound 465 on mail submission servers. Prefer 465 over 587 for new client configurations – implicit TLS has no downgrade attack window. Both 465 and 587 should be available for maximum client compatibility. Block outbound 465 from non-mail-server hosts.

Diagnosis commands

Test implicit TLS – should see certificate immediately (no STARTTLS needed)

shell
openssl s_client -connect smtp.example.com:465

Send test email via SMTPS port 465

shell
swaks --to [email protected] --server smtp.example.com --port 465 --tls --auth-user user

Usage examples

Port 465 – SMTPS
shell
openssl s_client -connect smtp.example.com:465
EHLO client.example.com
AUTH PLAIN <credentials>
MAIL FROM:<[email protected]>

Common services on this port

PostfixGmail SMTPMicrosoft 365Amazon SESFastmailProton Mail Bridge

Related ports

587

SMTP submission (STARTTLS)

25

SMTP relay (server-to-server)

993

IMAPS (receiving mail)

History

Port 465 was originally registered for smtps in 1997, revoked in 1998 when STARTTLS (port 587) was preferred, then reassigned by RFC 8314 in 2018 which formally recommended implicit TLS for email submission. The 20-year deprecation caused widespread confusion in documentation.

FAQ

Port 465 vs 587 – which should I configure?

RFC 8314 (2018) recommends port 465 (implicit TLS) for new configurations because it eliminates STARTTLS stripping attacks. Port 587 remains valid and widely used. Configure both on your server for maximum client compatibility. If you must pick one: 465 for security, 587 for legacy compatibility.

Specification

RFC 8314 – Port 465 specification →