Port 465: SMTPS
Port 465 is SMTP submission over implicit TLS, registered by IANA as submissions. Unusually, IANA has two live TCP assignments on this port: the historical urd and the mail service submissions added for RFC 8314.
| Port number | 465 |
|---|---|
| Service | SMTP submission over TLS |
| Protocol | TCP |
| Category | |
| Default encryption | Yes (TLS/SSH) |
| IANA service name | submissions (and, historically, urd) |
| IANA transports | TCP |
| Used in practice | TCP |
Is port 465 deprecated for email?
It was, and then it was not, which is why so much conflicting advice exists. Port 465 was used for SMTP over SSL in the late 1990s without a formal assignment. IANA then allocated the number to urd, a completely unrelated service, and the mail community was told to use STARTTLS on port 587 instead. For roughly two decades, guidance described 465 as deprecated.
RFC 8314, published in 2018 and titled Cleartext Considered Obsolete, changed the recommendation. It argues that implicit TLS is safer than starting in cleartext and hoping the upgrade succeeds, recommends implicit TLS in preference to STARTTLS for submission, and had IANA register the service name submissions on port 465 for it.
So both ports are correct today. Port 465 is implicit TLS, encrypted from the first byte. Port 587 is cleartext with a mandatory upgrade. If your client and provider both support 465, current guidance favours it.
What is the practical difference between implicit TLS and STARTTLS?
On port 465 the TLS handshake happens immediately, before any SMTP command exists. There is no window in which credentials or message content could be sent unprotected, and no negotiation for an attacker to interfere with.
On port 587 the client connects in clear text, reads the server's capability list, sees STARTTLS advertised, and asks to upgrade. An attacker able to modify traffic can remove STARTTLS from that list. A client configured to require TLS will refuse to continue, but a client configured merely to prefer it will carry on and authenticate in the clear. That downgrade is the attack implicit TLS makes impossible.
Which ports are related to port 465?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
What commonly listens on port 465?
- Postfix smtpd with smtps enabled, and Exim with tls_on_connect_ports
- Microsoft Exchange and Microsoft 365 submission endpoints
- Transactional mail providers, which usually document both 465 and 587
How do I check whether port 465 is open?
Port 465 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 465 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 465 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':465 ' | Lists the process bound to port 465 on Linux. On macOS use lsof -nP -iTCP:465 -sTCP:LISTEN, on Windows netstat -ano | findstr :465 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 465 or 587 better for sending email?
465, if both are available. It uses implicit TLS, so the connection is encrypted before any SMTP command is sent and there is no negotiation to strip. RFC 8314 recommends implicit TLS in preference to connecting in cleartext and using STARTTLS, which is what port 587 does.
Why do some guides say port 465 is deprecated?
Because it was, from the late 1990s until 2018. IANA had assigned the number to an unrelated service called urd, and mail guidance pointed people to STARTTLS on port 587. RFC 8314 reversed this and had IANA register submissions on port 465 specifically for mail submission over implicit TLS.
Is port 465 TCP or UDP?
TCP for mail. IANA does list igmpv3lite on UDP 465, which is unrelated to email, so a mail firewall rule should specify TCP 465 rather than both.
What is port 465 used for?
Port 465 is SMTP submission over implicit TLS, registered by IANA as submissions. Unusually, IANA has two live TCP assignments on this port: the historical urd and the mail service submissions added for RFC 8314.
Is port 465 secure?
Yes. Port 465 carries encrypted traffic by default, so data in transit is protected.
Should I open port 465 on my firewall?
Only if you specifically need SMTPS. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.