Skip to content
Webmaster Tools
SecurityPort ScannerPort 587 (Submission)

Port 587 (SMTP submission)

Port 587 is where mail clients and apps submit outgoing email, with STARTTLS and a login. How it differs from 25 and 465, Postfix setup and common errors.

What runs on port 587

TCP port 587 is the message submission port (RFC 6409). Mail apps, websites, scripts and printers connect here to send outgoing mail through their provider. Unlike port 25, submission requires the sender to log in (SMTP AUTH), and the server only then accepts mail for any destination.

The connection starts in plain text and is upgraded with STARTTLS before the login. A correctly configured server refuses AUTH until TLS is active, so the password is always encrypted. The alternative with TLS from the first byte is port 465.

Which port should your app use?

Setting in your app or library Port
STARTTLS, "TLS" in some apps, secure: false with requireTLS: true (Nodemailer) 587
SSL/TLS, implicit TLS, secure: true 465
No encryption, no login 25 (server-to-server only)

Most providers support both 587 and 465. Use the values your provider documents. Applications on cloud servers should send through 587 or 465, since outbound port 25 is commonly blocked on cloud networks and residential connections.

A typical configuration:

SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURE=starttls
SMTP_USER=app@example.com
SMTP_PASS=...

Postfix setup

To accept submission on your own server, enable the submission service in master.cf:

# /etc/postfix/master.cf
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

smtpd_tls_security_level=encrypt makes TLS mandatory, and smtpd_tls_auth_only=yes hides AUTH until TLS is up. SASL authentication itself usually goes through Dovecot (smtpd_sasl_type = dovecot). Then:

sudo postfix check && sudo systemctl reload postfix
sudo ufw allow 587/tcp

Test it

openssl s_client -connect smtp.example.com:587 -starttls smtp -crlf -quiet

You should see the certificate and then a 250 reply. Type EHLO test to confirm AUTH is listed after TLS, then QUIT. To check plain reachability: nc -zv smtp.example.com 587.

Common errors

  • "wrong version number" or a hang: the client tries implicit TLS on 587. Switch it to STARTTLS, or use 465.
  • "Must issue a STARTTLS command first": the client tried to log in or send before upgrading. Enable STARTTLS in the client.
  • "Authentication failed" or 535: wrong credentials, or the provider wants an app password or OAuth instead of the account password.
  • "Relay access denied" (554 5.7.1): the client did not authenticate.
  • Connection timeout: a firewall blocks outbound 587 on your network, or inbound on the server.

See what is listening

sudo ss -tlnp 'sport = :587'
sudo lsof -i :587

Security notes

  • Never accept unauthenticated mail on 587.
  • Limit sending rates per user so a stolen password can't send thousands of messages.
  • Authenticate your domain with SPF, DKIM and DMARC so mail you submit is delivered.

Check your domain's sending records with the Email Checker, and which ports your mail server answers on with the Port Scanner.