Skip to main content
protocols.pageprotocols.page
587

Port 587 – SMTP Submission

TCP

Port 587 is the standard port for authenticated email submission using STARTTLS. Email clients (Outlook, Gmail, Thunderbird) use port 587 to submit outgoing mail to their mail server. Unlike port 25, ISPs generally don't block port 587.

Port Number

587

Protocol

TCP

Service

SMTP with STARTTLS

Range

IANA Well-Known (0–1023)

Description

Port 587 is the message submission agent (MSA) port. Unlike port 25 which is for server-to-server relay, port 587 requires authentication and is used by email clients to submit mail. It uses STARTTLS to upgrade the connection to TLS after the initial plaintext handshake.

Security risks

  • 1Credential brute-forcing: port 587 requires authentication, making it a target for password spraying attacks against email accounts. Implement rate limiting and account lockout after 5 failed attempts.
  • 2STARTTLS stripping: a network attacker can intercept the connection before STARTTLS and prevent the TLS upgrade (downgrade attack). Configure your server to REQUIRE TLS (smtpd_tls_security_level=encrypt in Postfix) rather than making it optional.
  • 3Compromised credentials enable spam sending: once an attacker has valid port 587 credentials, they send spam through your server, getting your IP and domain blacklisted. Monitor outbound mail volume per account and set daily sending limits.

Firewall guidance

Allow inbound port 587 only on designated mail submission servers. All email clients (desktop, mobile, web) submit through 587. Block outbound 587 from servers that are not mail relays to prevent compromised servers from sending spam. Prefer port 465 (implicit TLS) for new configurations – it avoids STARTTLS stripping entirely.

Diagnosis commands

Test STARTTLS negotiation and certificate validity on port 587

shell
openssl s_client -connect mail.example.com:587 -starttls smtp

Send authenticated test email via port 587

shell
swaks --to [email protected] --server mail.example.com:587 --tls --auth-user user --auth-pass pass

Basic connectivity test – should see 220 banner

shell
telnet mail.example.com 587

Usage examples

Port 587 – SMTP Submission
shell
EHLO client.example.com
STARTTLS
AUTH PLAIN <credentials>

Common services on this port

PostfixEximMicrosoft ExchangeGmail SMTPSendGridAmazon SESMailgun

Related ports

25

SMTP relay (server-to-server)

465

SMTPS (implicit TLS)

993

IMAPS (receiving mail)

History

Port 587 for mail submission was defined in RFC 2476 (1998), updated by RFC 6409 (2011). It was created to separate authenticated client submission from unauthenticated server-to-server relay on port 25, enabling ISPs to block outbound 25 without breaking legitimate email sending.

FAQ

Should I use port 587 or 465 for sending email?

Port 465 (implicit TLS) is now the IETF-recommended submission port (RFC 8314, 2018). Port 587 (STARTTLS) works but is vulnerable to downgrade attacks. Gmail, Outlook, and most providers support both. New configurations should prefer 465.

Why does my app fail to send email on port 587?

Common causes: firewall blocking outbound 587, STARTTLS certificate verification failure (self-signed cert), wrong credentials, or the server requires AUTH before MAIL FROM. Test with: openssl s_client -connect host:587 -starttls smtp.

Specification

RFC 6409 – Port 587 specification →