Port 587: Submission
Port 587 is the SMTP mail submission port, registered as submission. A mail client connects here to hand outgoing mail to its own provider, authenticates, and upgrades the connection to TLS with STARTTLS.
| Port number | 587 |
|---|---|
| Service | SMTP mail submission (STARTTLS) |
| Protocol | TCP |
| Category | |
| Default encryption | Yes (TLS/SSH) |
| IANA service name | submission |
| IANA transports | TCP, UDP |
| Used in practice | TCP |
Why does mail submission have its own port?
Because relay and submission need different rules. A mail server accepting relay on port 25 has to accept connections from strangers, since that is how mail from other domains arrives. A submission server accepting mail from its own users can and should demand authentication for every message.
Separating them onto different ports let providers apply that distinction cleanly, and let ISPs block outbound port 25 to stop infected machines spamming the world directly without also cutting off every legitimate mail client. RFC 6409 defines the submission role, and port 587 is where it lives.
This is why a mail client configured for port 25 typically fails on a home connection while the same settings on 587 work: the traffic is being filtered as relay when it is really submission.
Which ports are related to port 587?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 465 | encrypted | Submission over implicit TLS, encrypted before the first command rather than upgraded mid-session. |
| 25 | plaintext | Relay between mail servers. Submission was split onto 587 so that 25 could be filtered without breaking users. |
| 143 | companion | IMAP, for reading mail. A working mail account needs a submission port and an access port. |
What commonly listens on port 587?
- Postfix and Exim submission listeners
- Microsoft 365 and Google Workspace SMTP endpoints
- Transactional providers such as any SMTP relay service you configure in an application
How do I check whether port 587 is open?
Port 587 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 587 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 587 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':587 ' | Lists the process bound to port 587 on Linux. On macOS use lsof -nP -iTCP:587 -sTCP:LISTEN, on Windows netstat -ano | findstr :587 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
What is the difference between port 587 and port 465?
Both are mail submission ports. Port 587 connects in clear text and then upgrades to TLS with STARTTLS. Port 465 uses implicit TLS, so the connection is encrypted before any SMTP command is sent. Current guidance in RFC 8314 prefers implicit TLS, so 465 where available.
Does port 587 require a password?
Yes, that is the point of it. Submission is defined as authenticated: the server accepts mail because it knows who you are, unlike relay on port 25 which accepts mail addressed to its own domains from anyone.
What is port 587 used for?
Port 587 is the SMTP mail submission port, registered as submission. A mail client connects here to hand outgoing mail to its own provider, authenticates, and upgrades the connection to TLS with STARTTLS.
Is port 587 TCP or UDP?
IANA assigns port 587 on TCP, UDP. In practice it carries TCP. The UDP registration is unused; mail submission is TCP.
Is port 587 secure?
Yes. Port 587 carries encrypted traffic by default, so data in transit is protected.
Should I open port 587 on my firewall?
Only if you specifically need Submission. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.