SMTP Settings Explained: Ports 25, 465, 587 and 2525, TLS and Authentication

SMTP settings tell your application how to hand a message to a mail relay. You need four things: a host name, a port, an encryption mode and a username and password. Choose port 587 with STARTTLS unless you have a reason not to, keep the connection encrypted, and send from a domain you have authenticated. This guide explains each setting and gives working examples for PHP, Python and Node.js.

The short version

1. Host. The SMTP server name from your dashboard, for example smtp.example.com.
2. Port and security. Port 587 with STARTTLS, or port 465 with SSL/TLS. Not both settings at once.
3. Authentication. Your SMTP username and password, sent only after the connection is encrypted.
4. From address. An address on a domain you have authenticated with SPF, DKIM and DMARC.
5. Test. Check the connection with openssl, then send one test message from your application.

The four settings

Which port should you use?

STARTTLS and SSL/TLS

On port 587 the client connects in plain text, asks the server what it supports, then sends the STARTTLS command to switch to an encrypted session. Only after that does it log in. On port 465 the TLS handshake happens immediately, before any SMTP command. Both end up equally protected as long as the client does require the upgrade: a client that continues in plain text when STARTTLS fails is open to a downgrade attack.

Authentication

After the encrypted session starts, the client logs in with the SMTP AUTH command, usually with the PLAIN or LOGIN mechanism. These send the username and password in a reversible encoding, which is safe only because the connection is already encrypted. That is why TLS must come first.

• Use SMTP credentials, not your account login. They can be rotated without locking you out of the dashboard.
• Keep them secret. Put them in environment variables or a secrets manager, never in source control or client-side code.
• One credential per application. If one is exposed you can revoke it without breaking everything else.
• Rotate on a schedule and immediately after any suspected leak.

Test the connection first

Before debugging application code, check that the server is reachable and TLS works from the machine that will send. For port 587:

openssl s_client -starttls smtp -connect smtp.example.com:587 -crlf

For port 465:

openssl s_client -connect smtp.example.com:465 -crlf

A good result shows the certificate chain, a TLS protocol version of 1.2 or 1.3 and a 220 greeting from the server. If the command hangs, the port is blocked or the host name is wrong.

Send a message from code

PHP with PHPMailer

use PHPMailer\PHPMailer\PHPMailer;

$mail = new PHPMailer(true);
$mail->isSMTP();
$mail->Host       = getenv('SMTP_HOST');
$mail->Port       = 587;
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
$mail->SMTPAuth   = true;
$mail->Username   = getenv('SMTP_USER');
$mail->Password   = getenv('SMTP_PASS');
$mail->setFrom('hello@mail.example.com', 'Example');
$mail->addAddress('user@example.net');
$mail->Subject = 'Test message';
$mail->Body    = 'It works.';
$mail->send();

Python with smtplib

import os, smtplib
from email.message import EmailMessage

msg = EmailMessage()
msg["From"] = "hello@mail.example.com"
msg["To"] = "user@example.net"
msg["Subject"] = "Test message"
msg.set_content("It works.")

with smtplib.SMTP(os.environ["SMTP_HOST"], 587, timeout=30) as s:
    s.starttls()
    s.login(os.environ["SMTP_USER"], os.environ["SMTP_PASS"])
    s.send_message(msg)

Node.js with Nodemailer

const nodemailer = require("nodemailer");

const transport = nodemailer.createTransport({
  host: process.env.SMTP_HOST,
  port: 587,
  secure: false,        // false for STARTTLS on 587, true for port 465
  requireTLS: true,     // fail instead of sending in plain text
  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
});

await transport.sendMail({
  from: "hello@mail.example.com",
  to: "user@example.net",
  subject: "Test message",
  text: "It works.",
});

Good sending habits

• Reuse connections. Opening a new TLS session for every message is slow. Keep a connection open and send many messages through it, within your provider limits.
• Set timeouts. Use a connect and a read timeout of about 30 seconds so a stuck connection does not block your application.
• Retry 4xx, stop on 5xx. A 4xx reply is temporary: retry with a growing delay. A 5xx reply is permanent: log it and do not retry. See the bounce code guide.
• Log the full reply. Store the complete server response, not only the code. The text usually names the problem.
• Send from an authenticated domain. Set up SPF, DKIM and DMARC first, as described in authenticate a sending domain.
• Queue in your application. Put messages on a queue and send from a worker, so a slow relay never slows a web request.

Common errors and fixes

Further reading and sources

• RFC 6409: Message Submission for Mail
• RFC 8314: Cleartext Considered Obsolete: Use of TLS for Email Submission and Access
• RFC 3207: SMTP Service Extension for Secure SMTP over TLS
• RFC 4954: SMTP Service Extension for Authentication
• PHPMailer documentation
• Nodemailer SMTP transport documentation
• Related guides: SMTP bounce codes explained and Authenticate a sending domain.