SMTP Port 587 vs 465 vs 25: Which One Should You Use?

If you are setting up a mail client or a script that sends email and the settings screen asks for an SMTP port, you are almost certainly choosing between 587, 465, and 25. The short version of smtp port 587 vs 465 vs 25 is that 587 and 465 are for sending mail from an app, and 25 is for mail servers talking to each other. Pick the wrong one and the connection either times out, gets refused, or hangs before it ever asks for your password.

This page settles the choice. It separates the two jobs these ports do, cites the standard behind each, explains why your provider blocks port 25, and shows where the unofficial port 2525 fits. By the end you will know which number to type, and why.

What 587, 465, and 25 actually do#

Every SMTP port falls into one of two jobs. Submission is a mail client or app handing a new message to a server you have logged into — this is what happens when you hit send. Relay is one mail server passing that message on to the next server on its way to the recipient. Ports 587 and 465 are submission ports. Port 25 is the relay port.

That distinction answers most of the question. When your app sends mail it should connect on a submission port and log in with your username and password. It should not use port 25, which was built for anonymous server-to-server handoff, not for a logged-in person sending a message.

• Port 587 — submission with STARTTLS. The default modern choice for sending from an app or client.
• Port 465 — submission with implicit TLS. Encrypted from the first byte, and no longer deprecated.
• Port 25 — server-to-server relay. Not for your app, and blocked outbound by most consumer networks.

The three ports at a glance#

The table below is the whole decision in one view. The two things that matter are the port's job — submission or relay — and how it handles encryption.

Why your email won't send: symptom to cause#

Most SMTP failures come down to a port and its encryption mode not matching what the server expects. Match your symptom below, then jump to the fix for it.

Fix 1: Send on port 587 with STARTTLS#

This is the default, and the setting to try first. Port 587 is the standard submission port defined in RFC 6409, and it works with virtually every provider.

1. 1

   Set the port to 587

   In your mail client or sending library, set the outgoing SMTP port to 587.

2. 2

   Set security to STARTTLS

   Choose STARTTLS, sometimes labelled just 'TLS' — not 'SSL/TLS'. It opens a plain connection, then upgrades to encryption before your credentials are sent.

3. 3

   Turn on authentication

   Enter your full email address and password, an app password, or an OAuth token. Submission servers require SMTP AUTH, which is central to how RFC 6409 defines message submission.

4. 4

   Send a test message

   Send yourself an email. A clean send confirms the port, the TLS upgrade, and the login all succeeded together.

Fix 2: Send on port 465 with implicit TLS#

Use 465 when your provider's help page names it, or when you want the connection encrypted from the first byte with no upgrade step. It does the same submission job as 587; only how encryption starts is different.

1. 1

   Set the port to 465

   Set the outgoing SMTP port to 465.

2. 2

   Set security to SSL/TLS (implicit)

   Choose 'SSL/TLS' or 'implicit TLS'. The connection is encrypted from the start, with no STARTTLS step. Do not select STARTTLS on 465 — that mismatch causes most 465 failures.

3. 3

   Authenticate the same way

   Log in with your email address and password, app password, or token, exactly as you would on 587.

4. 4

   Fall back to 587 if it fails

   Most major providers offer both ports. If 465 will not connect, try 587 — RFC 8314 recommends servers support both during this transition period.

Fix 3: When port 25 is blocked, move to a submission port#

If a connection to port 25 times out from a home, office, or cloud network, the port is almost certainly blocked, not broken. The fix is not to force it open — it is to stop using port 25 for sending and switch to a submission port.

1. 1

   Confirm the block

   A timeout on port 25 from a home connection or a cloud host is the signature of a block. Most consumer ISPs block outbound port 25 to stop infected machines from sending spam directly, and many hosts do the same.

2. 2

   Switch submission to 587 or 465

   Point your app at 587 (STARTTLS) or 465 (implicit TLS) instead. These are the ports meant for sending from an app, and they are rarely blocked.

3. 3

   Use 2525 only if your provider offers it

   Some sending providers expose port 2525 as a fallback for networks that block 587 too. It is not an official SMTP port — IANA assigns 2525 to an unrelated service — so use it only when your provider documents it.

4. 4

   Leave port 25 for servers

   Keep port 25 for its real job: your mail server relaying to the recipient's mail server. Your app should never need it.

How to tell which port you need#

If you are still unsure, run down this list. It resolves nearly every real case in one pass.

• Sending from an app, client, or script? Use a submission port — try 587 first, then 465 if your provider documents it.
• Getting a timeout on 25 from home, the office, or a VPS? The port is blocked, not broken — switch to 587 or 465.
• Does your provider's help page name a specific port and mode? Follow it exactly; a few providers require one over the other.
• Does 587 fail but 465 is offered, or the reverse? Try the other submission port before assuming a bigger problem — many servers support both.
• Configuring a mail server to relay to other servers? That is the one job port 25 is still for.

Preventing it: getting SMTP right the first time#

The most common self-inflicted failure is pairing the wrong encryption mode with a port — STARTTLS on 465, or implicit SSL/TLS on 587. Get the pairing right, default to 587, and most 'won't connect' problems never appear. Reserve port 25 for server-to-server relay and never point a mail client at it.

One caveat worth a date stamp: providers occasionally change which submission ports they support. As of 2026 the safe pattern is 587 with STARTTLS by default and 465 with implicit TLS as the alternative — but always check your provider's own current help page, which is the authority for your account and where any change shows up first.

A wrong port fails silently because submission is a handshake: the client and server have to agree on the port and the TLS mode before authentication begins, so a mismatch dies before any 'wrong password' message can appear. AI Emaily takes that step off your plate — connect Gmail or Outlook and it authenticates over OAuth with no SMTP port to set, and for an IMAP mailbox it fills in the standard submission port and TLS mode for known providers rather than making you guess. We build AI Emaily; it does not change how SMTP works underneath, it just means you rarely have to hand-configure the port yourself.