SMTP port 25 is the original port for email transfer between mail servers. For most people who send email from an application, a website or a mail client, it is not the right port: port 25 is often blocked by internet providers and cloud hosts, and it has no standard requirement for sign-in. The ports for sending from your own systems are 587, which uses STARTTLS, and 465, which uses SSL/TLS from the first byte. This guide explains what each port is for, why port 25 gets blocked, how to test whether a port is open, and which to choose.
What each SMTP port is for
| Port | Purpose | Encryption | Use it for |
|---|---|---|---|
| 25 | Relay between mail servers (MTA to MTA) | Opportunistic STARTTLS, often optional | Receiving mail on your own server, and server-to-server delivery. Not for client submission |
| 587 | Message submission (client or application to server) | STARTTLS, required by most services | Sending from applications, websites and mail clients |
| 465 | Message submission over implicit TLS | SSL/TLS from the start | The same as 587, where the client or service prefers implicit TLS |
| 2525 | Not an official SMTP port. Some services offer it as an alternative | Varies | Only when your provider says so, usually when other ports are blocked |
Port 25 is the port that mail servers use to hand messages to each other. When your message leaves your provider and goes to the recipient's provider, that last hop normally uses port 25. Ports 587 and 465 are for the first hop, from you to your own provider. RFC 6409 defines message submission, and RFC 8314 recommends encryption from the start of the connection. See our guide to SMTP settings, ports, TLS and authentication for the full set of values.
Why port 25 is blocked
Spam sent from infected computers and compromised servers has historically gone out over port 25. To stop it, many internet providers block outbound connections on port 25 from home and business customer networks. Several cloud and hosting providers do the same by default, and allow you to ask for the block to be lifted. If you try to use port 25 from such a network, the connection times out and your application reports an error such as "connection timed out" or "could not connect".
Blocking is not a fault in your settings, and you will not fix it by changing the password. The fix is to send through a submission port to a relay that you authenticate with, or to ask your host to unblock port 25 if you run your own mail server. For a longer explanation of connection errors, see SMTP connection, timeout and TLS troubleshooting.
Port 587 or port 465?
Both are correct for sending, and both are encrypted. Port 587 starts as a normal connection and then upgrades to an encrypted one with the STARTTLS command. Port 465 is encrypted from the first byte. Choose the one that your application or service supports. Do not mix the port and the security mode: STARTTLS on port 465 or implicit TLS on port 587 produces "wrong version number" or similar errors. Our explainer on email SSL, TLS and STARTTLS shows why.
For our SMTP relay, the host is smtp.migosmtp.com on port 587 with STARTTLS. Check your dashboard and the SMTP relay page for the settings that apply to your account.
How to test whether a port is open
# Test a TCP connection to a mail server port
nc -vz smtp.example.com 587
# Open an encrypted session on 587 and watch the greeting
openssl s_client -starttls smtp -connect smtp.example.com:587
# Open an implicit TLS session on 465
openssl s_client -connect smtp.example.com:465If the connection succeeds and you see a server greeting that starts with 220, the port is open from your network. If it hangs and times out, something between you and the server is blocking it. Try the same test from another network to find out whether the block is local. Replace smtp.example.com with your provider's host name.
Running your own server on port 25
If you operate your own mail server, you need port 25 open in both directions, because other servers will connect to you on that port to deliver mail. You also need valid reverse DNS, a sensible HELO name and authenticated sending, or large providers will refuse your mail. See reverse DNS, PTR and HELO names and what is an SMTP server. Many teams find that running their own sending is more work than it is worth and use a relay instead, as described in SMTP servers vs SMTP services.
Which port should I use?
- Sending from an app, site or mail client: use 587 with STARTTLS, or 465 with SSL/TLS if your provider prefers it.
- Receiving mail on your own server: port 25 must be open to the internet.
- Port 25 times out from your host: do not fight it. Use a submission port to a relay.
- Both 587 and 465 are blocked: ask your network or host. Some providers offer an alternative port, so check their documentation instead of guessing.
Always authenticate and encrypt. Never send credentials over an unencrypted connection. Use a submission port with TLS, keep passwords or keys in environment variables and rotate them if they leak.
Common port mistakes and their symptoms
| Mistake | What you see | Fix |
|---|---|---|
| Using port 25 from a home or cloud network | Connection timed out | Switch to 587 or 465 on an authenticated relay |
| STARTTLS selected with port 465 | Wrong version number, or the connection hangs | Use SSL/TLS with 465, or STARTTLS with 587 |
| No encryption on a submission port | The server refuses to accept the login, or it asks for STARTTLS first (a 530 reply) | Turn on STARTTLS or SSL/TLS |
| Mail client set to port 25 with a password | Login rejected or never attempted | Use a submission port with authentication |
| Firewall allows only 443 and 80 | All SMTP ports time out | Open the submission port outbound, or use an HTTPS email API |
When an API is a better answer than any port
If your network blocks every SMTP port and you cannot change it, sending over HTTPS is the simplest way around the problem. An email API accepts your message as a normal web request on port 443, which is rarely blocked. It also removes the need to manage SMTP connections in your code. Our comparison of SMTP and API sending explains when each is the better choice, and the email API page describes how it works with us.
Ports and receiving mail
Everything above is about sending. For receiving mail, the rules are different. A mail server listens on port 25 to accept messages from other servers. Mail clients read the messages afterwards with IMAP or POP3, which use their own ports, as covered in IMAP, POP3 and SMTP compared. If you want your application to receive replies, you do not need to run a server at all: an inbound parse service can receive the mail and send it to your application, as described in the inbound email guide.
Send without worrying about blocked ports Use authenticated submission on port 587 with TLS, with logs for every message. Create your account and send a test message in a few minutes.
References and further reading
Frequently asked questions
What is SMTP port 25 used for?
Port 25 is the standard port for mail transfer between mail servers. It is how a message passes from one provider to another. It is not the recommended port for sending from an application or mail client.
Why is port 25 blocked?
Many internet providers and cloud hosts block outbound port 25 from customer networks because spam from infected machines has historically used it. The connection times out. Use port 587 or 465 to an authenticated relay.
Should I use port 587 or 465?
Both are correct and both are encrypted. 587 uses STARTTLS and 465 uses SSL/TLS from the first byte. Pick the one your provider supports and match the security mode to the port.
How can I test if an SMTP port is open?
Use a tool such as nc -vz host 587 to test the connection, or openssl s_client with -starttls smtp to see the server greeting. A timeout suggests that something blocks the port.
Is port 2525 an official SMTP port?
No. Some providers offer it as an alternative when other ports are blocked. Use it only if your provider documents it.