Why Port 587 Is the Modern Standard for Secure Email Submission

Port 587 is the industry-standard virtual communication endpoint used for the submission of email messages by a client to a mail server. In the technical framework of the Simple Mail Transfer Protocol (SMTP), this port is specifically designated for Mail Submission Agents (MSA) to receive messages from Mail User Agents (MUA), such as Microsoft Outlook, Apple Mail, or custom-coded applications. Unlike its predecessor, Port 25, which is primarily used for server-to-server relaying, Port 587 is optimized for security, requiring modern encryption and authentication protocols to protect sensitive data during transit.

The Role of Port 587 in SMTP Architecture

To understand why Port 587 exists, it is necessary to differentiate between "email submission" and "email relay." In the early days of the internet, the SMTP protocol (defined in RFC 821) used Port 25 for everything. Whether a person was sending an email from their computer or one server was passing an email to another, Port 25 handled the traffic.

As the internet scaled, this lack of specialization led to significant problems, most notably the explosion of spam. Because Port 25 did not originally require authentication, anyone could connect to an open mail relay and send millions of unsolicited messages. To combat this, the Internet Engineering Task Force (IETF) introduced RFC 2476, which formally defined a separate "submission" service. This service was assigned to Port 587.

The Mail Submission Agent (MSA)

When a user clicks "send" in their email client, the client connects to the mail server's MSA. The MSA acts as a gatekeeper. Its job is to:

1. Authenticate the User: Ensure the sender is a legitimate user of the system.
2. Validate the Message: Check for formatting errors or potential spam indicators.
3. Encrypted Transmission: Ensure the data is not sent in cleartext.

By using Port 587 for this specific task, network administrators can apply strict security policies to user submissions without interfering with the standard Port 25 traffic used for server-to-server communication.

Technical Superiority: Security and Authentication

The primary reason Port 587 is the recommended choice for almost all modern email configurations is its inherent support for secure communication protocols, specifically STARTTLS and SMTP Authentication.

How STARTTLS Works on Port 587

STARTTLS is a protocol command that tells an email server that the email client wants to upgrade an existing insecure connection to a secure one using TLS (Transport Layer Security).

When a client connects to Port 587, the initial handshake occurs in plain text. However, the client immediately issues the STARTTLS command. If the server supports it, the two parties perform a TLS handshake, establishing an encrypted tunnel. From that point forward, all data—including the user's login credentials and the body of the email—is encrypted. This protects against "man-in-the-middle" (MITM) attacks where a malicious actor on the same network might attempt to sniff sensitive information.

Mandatory Authentication

One of the defining characteristics of Port 587 is that it almost always requires authentication. Unlike Port 25, which might accept mail from any server to deliver to its local users, an MSA on Port 587 will refuse to accept any message unless the client provides valid credentials (typically a username and password). This requirement is the single most effective barrier against the use of personal computers and compromised devices as spam-bot nodes.

Comparative Analysis: Port 587 vs. Alternatives

Choosing the right port is critical for ensuring that emails are not only sent securely but also delivered at all. Many users find themselves choosing between 25, 465, 587, and 2525.

Port 587 vs. Port 25

Port 25 is the oldest SMTP port, and today it is strictly intended for MTA-to-MTA (Mail Transfer Agent) communication. Most residential Internet Service Providers (ISPs) and cloud hosting providers (like AWS, Google Cloud, and Azure) block outbound traffic on Port 25 by default. This is because Port 25 is the primary channel for mass spamming. If a user's computer becomes infected with malware, the malware will often try to send spam directly via Port 25. By blocking this port, ISPs prevent their IP ranges from being blacklisted. Consequently, using Port 25 for client submission is highly unreliable and generally discouraged.

Port 587 vs. Port 465

Port 465 was originally registered for SMTPS (SMTP over SSL). The difference here is "Implicit TLS." Unlike Port 587, which starts in plain text and upgrades, Port 465 requires the connection to be encrypted from the very first byte.

In the late 1990s, the IANA (Internet Assigned Numbers Authority) briefly reassigned Port 465 to a different service, and Port 587 became the official standard. However, Port 465 remained popular because many legacy systems were already using it. In 2018, RFC 8314 officially reinstated Port 465 for encrypted email submission.

While Port 465 is technically secure, Port 587 remains the more widely supported and "standard" choice for MUAs. Port 587’s use of STARTTLS makes it more flexible for negotiating the highest possible security level that both the client and server support.

Port 587 vs. Port 2525

Port 2525 is not an official IETF-sanctioned port. It is an alternative commonly offered by Email Service Providers (ESPs) such as SendGrid, Mailgun, and others. Its purpose is simple: to serve as a fallback when Port 587 is blocked by a restrictive corporate firewall or a specific ISP. It typically supports the same security features as Port 587 (authentication and STARTTLS) but operates on a non-standard number to bypass filters.

Implementing Port 587 in Real-World Scenarios

Whether you are configuring a desktop client or writing code for a web application, Port 587 is the safest default. Most major email providers mandate its use to ensure the integrity of their platforms.

Configuring Desktop and Mobile Clients

When setting up an account in Outlook, Thunderbird, or an iPhone, the software will usually attempt to auto-configure the settings. If manual setup is required:

• Outgoing Mail Server (SMTP): smtp.provider.com
• Port: 587
• Encryption Method: STARTTLS (sometimes labeled as TLS or SSL/TLS depending on the UI)
• Authentication: Required (Use same settings as incoming mail server)

Developer Integration: Using Port 587 in Code

For developers building notification systems or newsletters, connecting to an SMTP server via Port 587 is a standard task. Most libraries handle the STARTTLS negotiation automatically.

In a Node.js environment using the popular Nodemailer library, the configuration would look like this: