Port 465 (SMTPS)

What runs on port 465

TCP port 465 is message submission over implicit TLS, often called SMTPS. Mail clients and applications connect, start TLS immediately (before any SMTP command), log in and hand over outgoing mail. Because the TLS handshake comes first, the connection is encrypted from the start and there is no plain-text phase an attacker could tamper with.

Port 465 has an odd history. It was registered for SMTP over SSL in the 1990s, then the registration was revoked in favor of STARTTLS on port 587. Clients kept using it anyway, and RFC 8314 (2018) assigned it again, officially, for submission over implicit TLS. Newer /etc/services files call it submissions; older ones say smtps or urd.

465 vs 587 vs 25

RFC 8314 recommends that clients prefer implicit TLS (465) over STARTTLS (587). In practice both are fine as long as the client requires encryption. Use whichever your provider documents; most offer both. If your app or library has an option like secure: true or "SSL/TLS", that means 465; "STARTTLS" means 587. Mixing them up (TLS on 587, or STARTTLS on 465) is the most common cause of a hanging connection or a "wrong version number" error.

Should it be open to the internet?

Only on a mail server where users or apps send mail. If you run Postfix and want 465, enable the service in master.cf:

# /etc/postfix/master.cf
submissions inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submissions
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

Older Postfix packages ship this block commented out under the name smtps; the name only has to match an entry in /etc/services. Then reload Postfix and open the port:

sudo postfix check && sudo systemctl reload postfix
sudo ufw allow 465/tcp

If no user sends through this server, leave 465 closed.

Test it

openssl s_client -connect mail.example.com:465 -crlf -quiet

A certificate chain followed by 220 mail.example.com ESMTP means it works. Type EHLO test to see AUTH methods, then QUIT. You can also check the certificate with our SSL Checker.

See what is listening

sudo ss -tlnp 'sport = :465'
sudo lsof -i :465

The process is normally Postfix's master or Exim.

Outbound blocks

Some networks block outbound 465 and 587 along with 25, though far fewer than block 25. If your app times out connecting to a provider, test from the same machine with nc -zv smtp.example.net 465. A timeout points to a firewall; "connection refused" means the host isn't listening on that port.

Security notes

• Require authentication on 465 and never relay unauthenticated mail.
• Rate-limit and watch logins: stolen mailbox passwords are used to send spam through submission ports.
• Use app passwords or OAuth where your provider requires them; many no longer accept the normal account password for SMTP.

Related ports

• Port 587 (Submission): the STARTTLS alternative.
• Port 25 (SMTP): server-to-server delivery.
• Port 993 (IMAPS): reading mail over implicit TLS.

See which mail ports your server exposes with the Port Scanner.