Port 587 is the TCP port assigned to SMTP mail submission (RFC 6409). It replaced port 25 for client-to-server mail sending starting in 1998, precisely because port 25 was becoming a spam vector. Every modern mail client and every reputable SMTP relay listens on port 587 for authenticated submission.
Why Port 587 Is Separate From Port 25
- Port 25 = server-to-server relay (unauthenticated by design)
- Port 587 = client-to-server submission (requires authentication)
Separating the two lets ISPs block outbound port 25 (to fight spam) without breaking legitimate mail clients — they connect on 587 instead.
STARTTLS Upgrade
Port 587 starts as plaintext SMTP. The client issues STARTTLS; the server responds with 220 Ready to start TLS; both parties negotiate a TLS session and resume SMTP encrypted.
C: EHLO client.example.com
S: 250-mail.provider.com Hello
S: 250-STARTTLS
S: 250 AUTH LOGIN PLAIN
C: STARTTLS
S: 220 Ready to start TLS
<TLS handshake>
C: EHLO client.example.com (starts over inside TLS)
S: 250 mail.provider.com Hello
C: AUTH LOGINSTARTTLS Downgrade Risk
An attacker on-path can strip the STARTTLS advertisement from the server’s response — the client thinks TLS isn’t offered and falls back to plaintext. MTA-STS + TLS-RPT and DANE close this gap. SUBMISSION+STARTTLS clients today should require STARTTLS and refuse plaintext.
Ports at a Glance
| Port | Purpose | TLS |
|---|---|---|
| 25 | Server-to-server relay | Optional (STARTTLS) |
| 465 | Submission (SMTPS) | Implicit TLS |
| 587 | Submission | STARTTLS |
Check whether port 587 is reachable with the port scanner.
Related
Check the Port 25 glossary entry, the Port 465 entry, and read what an SPF record is — SPF still applies regardless of which submission port your client uses.