Which SMTP Port Should I Use: Port 25, 465, 587 or 2525?

People configuring an app or mail system to send (or relay) email often have a common question: “What SMTP port should I use?” You might see information that tells you to use ports 25, 465, 587, or 2525 for SMTP relay. So, which of these should be your standard SMTP port? Here’s what you need to know, and why.


What is an SMTP port?

SMTP (Simple Mail Transfer Protocol) is the basic standard that mail servers use to send email to one another across the internet. SMTP is also used by applications such as Apple Mail or Outlook to upload emails to mail servers that then relay them to other mail servers. (On the other hand, mail apps typically rely on other standards such as IMAP or POP3 to retrieve emails from servers.)

Like other Internet services such as web sites, SMTP email relies on domain names and Internet addresses to know where to send messages. All of us today are familiar with the textual version of these addresses, like www.sparkpost.com. Most of us know that the text address stands in for a numeric IP address like 107.21.246.67. But not as many of us know that these network addresses also include specific “port numbers.” An “SMTP port” refers to the specific part of the Internet address that’s used to transfer email.

The web and HTTP use port number 80. For email and SMTP, that port number is… well, it depends.

SMTP ports

How can you find out what your SMTP port is?

If you are subscribed to a hosted email relay service you can get the SMTP server hostname and port number from the support page of your email service.

If you run your own SMTP server you can find the configured SMTP port number and address from the SMTP server configuration. In PowerMTA you can find that information from the configured “smtp-listener” directive within the config file. The config file can be found in /etc/pmta/config on a Linux server and C:\pmta\config.dat on Windows Server.

smtp-listener 10.0.1.22:587 # listens on port 587 and IP 10.0.1.22

Which port should you use for SMTP?

Ports 25, 465, 587, or 2525 for SMTP have all been considered standard SMTP ports at some point, but only 587 or 2525  really should be considered for modern use.

If you’re configuring your systems to use SparkPost as an SMTP relay, you should use port 587 as your standard SMTP port, with 2525 as an alternate in case port 587 is not available.

I’ll explain why as we run through the different ports commonly used for sending email today.

SMTP Ports


Port 25: The original standard SMTP port

Port 25 is the original standard SMTP port. Today, the Internet Assigned Numbers Authority (IANA), the group responsible for maintaining the internet addressing scheme, still recognizes port 25 as the standard, default SMTP port. SMTP was designated to use port 25 in IETF Request For Comments (RFC) 821. But in practicality, it’s not as simple as it seems.

Although port 25 continues to be used for server-to-server SMTP relaying, most modern SMTP clients should not be configured to use this port, because port 25 is usually blocked by residential ISPs and business cloud hosting providers alike.

Port 25

Why is port 25 usually blocked? How can you check if it is?

Port 25 is blocked on many networks to curb the amount of spam that is relayed from compromised computers or servers. Unless you’re specifically managing a mail server, you should have no traffic traversing this port on your computer or server.

To check if port 25 is blocked by an ISP:

  1. If you are using Windows, open up your command prompt. If you are using a Mac, open up your Terminal. And, if you are using Linux, open up your Terminal emulator.
  2. Type the following command: telnet examplemailserver.com 25

If port 25 is not blocked, you should receive a message like this one:

user@localhost:~# telnet gmail-smtp-in.l.google.com 25
Trying 1.2.3.4...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP 123si3448417qkd.359 - gsmtp

If you receive a message similar to the one below, port 25 is likely blocked:
telnet: connect to address XX.XX.XX.XX: Connection refused
telnet: Unable to connect to remote host

When would you use port 25?

Port 25 is the default port for relaying email on the internet. However, you can specify any port number (Provided it is within the acceptable range of custom port numbers) for submitting emails to your SMTP server. 

There are special cases when you must use port 25 on your SMTP server. One of such cases is to receive out of band/asynchronous bounces. This kind of bounces happen after the fact. This means the recipient domain accepts a message from your SMTP server but later bounces the message. Out of band bounces are sent asynchronously to the return path (MAIL FROM) address of the original message. The recipient domain will attempt to send these bounces to the MX server of the return path address and on port 25 (Because port 25 is the default port for relaying email on the internet). Another example is to receive FeedBack Loops (FBL).

You can enable port 25 for receiving messages on a PowerMTA server by configuring the “smtp-listener” directive

smtp-listener 10.0.1.22:25    # listens on port 25 and IP 10.0.1.22


Port 465: Deprecated and out-of-date SMTP port

Port 465 is no longer an accepted standard for SMTP. However, there are some legacy systems that still use port 465 for SMTP, and some help pages on the internet still suggest port 465 as the recommended setup. Our advice? Don’t do it unless your application absolutely requires it. 

IANA initially assigned port 465 for an encrypted version of SMTP called SMTPS. Initially, it was proposed to send emails using the Secure Sockets Layer (SSL). However, IANA has since reassigned this port for a different use, so it should no longer be used for SMTP. This is why SparkPost does not accept connections on port 465.


Port 587: The standard secure SMTP port

Modern email servers use port 587 for the secure submission of email for delivery. For example, if you use an email client software like Outlook or Apple Mail, it most likely is configured to use this port to send your messages. It’s not just personal email client software, however. Systems that transmit messages to an email delivery service like SparkPost also should be configured to use this port.

All SparkPost customers should use port 587 as default, unless you’re explicitly blocked by your upstream network or hosting provider. Using port 587, coupled with TLS encryption, is the best way to ensure that email is submitted securely and reliably to SparkPost (or nearly any other provider).


Port 2525: A common alternate SMTP port

Port 2525 is not an official SMTP port, and it is not sanctioned by the IETF nor IANA. However, SparkPost and many other email service providers support the use of port 2525 as an alternative to port 587 for SMTP, in the event the above ports are blocked. (One notable example where this is required is for services hosted on Google Compute Engine.) If you’ve tried port 587 but experience connectivity issues, try port 2525. Just like port 587, most implementations that listen on port 2525 also support TLS encryption.

What is an SMTP server?

An SMTP server is a computer that powers the protocol your email client uses when sending, receiving and/or relaying outgoing messages. As part of the process, an SMTP server verifies that a sender is allowed to send through the SMTP and, if the sender is allowed to send and the message is deemed undeliverable, the SMTP server will send it back to the MAIL FROM address. PowerMTA is one of the leading SMTP servers as it allows senders to adopt the latest authentication specifications for sending high volume emails and to comply with new authentication policies.

How to set up your SMTP server

When it comes to setting up an SMTP server there are two options to explore. You can subscribe to a hosted email relay service. SparkPost is a leading provider of email delivery and analytics service. Alternatively, you can setup your “on-premises” SMTP server for more granular control. An example is PowerMTA.

To stand up a PowerMTA server, contact support@port25.com for installation package, license and installation instructions. All PowerMTA configuration is done within the config file which is found in /etc/pmta/config on a Linux server and C:\pmta\config.dat on Windows Server.

For a basic configuration of your SMTP server, there are a few considerations and steps to take.

  1. What IP address and port number do you want your SMTP server to receive emails? Port 25 is the default port for email relaying. In PowerMTA you can change this default port number by editing the “smtp-listener” directive in the config file.
    smtp-listener 0/0:25 # listens on port 25 of all local IPs. 
    You can also specify a CIDR range of IP addresses
    

    or
    smtp-listener 10.0.1.22:25 # listens on port 25 and IP 10.0.1.22
  2. You must permit relaying of messages from your email client to your SMTP server. Your SMTP server should NEVER be an open relay. This means you must somehow selectively allow relaying. In PowerMTA there are a few ways to do this.You can authenticate with username and password. PowerMTA supports authentication with either LOGIN, PLAIN or the CRAM-MD5 mechanism for inbound connections. This is configured within the smtp-user and source stanza of the config file. For a user “foo” and password “barbaz”
    <smtp-user foo>
        password barbaz
        authentication-method password  #certificate (TLS) or system(linux user) are other options
    </smtp-user>
    
    #Then require authentication at the source stanza
    <source 0/0>
        require-auth true
    </source>

    You can also selectively allow relaying from a specific IP address or CIDR range. This would be the IP address of your email client.
    <source 10.0.5.20>
       always-allow-relaying yes   # allow feeding from 10.0.5.20
    </source>

    You can also set a recipient domain name/address (or pattern) for which PowerMTA will accept email.
    # allow relaying of mail to some.domain
    relay-domain some.domain
    relay-address bounce@bounce.yourdomain.com
    relay-address /@foo(bar)?\.com$/  # regex pattern
  3. Another consideration is if you want to securely relay emails from your email client to your SMTP server (Inbound TLS)? If your answer is yes then you must enable STARTTLS for inbound connections and configure a TLS certificate. In PowerMTA TLS is supported from TLSv1 to TLSv1.3.
    smtp-server-tls-certificate /etc/pmta/yourcert.pem
    
    #Enable TLS on inbound connections
    <source 0/0>
       allow-starttls true
       require-starttls-before-auth true #ensures authentication information is only sent over tls
    </source>
  4. Do you want your SMTP server to securely deliver emails to remote servers (Outbound TLS)? In PowerMTA you have the option to use TLS if the remote server supports it or to enforce TLS and drop the connection if TLS is not supported by the remote server.
    <domain *>           # (*) is a wildcard for all recipient domain
      use-starttls true  #uses TLS if available
      require-starttls true #enforces TLS 
    </domain>
  5. Set the IP address and hostname from which your SMTP server is to initiate outgoing SMTP connections. In PowerMTA this is set with the smtp-source-host directive.
    smtp-source-host 192.168.0.10 mail10.yourserver.com #You can also specify CIDR range
  6. Finally, one very unique feature of PowerMTA is the ability to separate your mail stream by building a multi-homed host. The VirtualMTA technology in PowerMTA allows users to define and control the source IP address, hostname and message delivery parameters for each mail stream. This allows for creating separate and specific campaigns, customers or departments, while still running just one instance of PowerMTA.

<virtual-mta mta1>
   smtp-source-host 1.2.3.4 mta1.yourserver.com
<domain *>          
  use-starttls true 
  require-starttls true
  retry-after  10m
</domain>
</virtual-mta>

<virtual-mta mta2>
   smtp-source-host 2.3.4.5 mta2.yourserver.com
<domain *>          
  use-starttls false 
  require-starttls false
  retry-after  45m 
</domain>
</virtual-mta>

When the basic setup is completed you can submit messages to your SMTP server configured hostname/IP and port number (10.0.1.22:25 in example above ) and depending on how you permit email submission authenticate with the configured username (foo) and password (barbaz).


Learn More

In summary, SMTP port 587 is the best choice for nearly every use case for connecting to SparkPost and other email delivery services.

I hope this information helped you learn a little more about which SMTP port to use! Want to learn more about using SMTP? Here are instructions for configuring SparkPost for SMTP relay and email delivery, the differences between SMTP and API message transmission, and troubleshooting your SMTP connection to SparkPost.

~ Lade