SMTP Ports 25, 465 and 587: Which One to Use

Use port 587 with STARTTLS, or port 465 with implicit TLS (Transport Layer Security), when a website form, printer or app sends email through your mailbox provider. Both encrypt the connection and expect the device to sign in.

Port 25 is for mail servers passing messages to each other, and many networks block it for anything else.

The port and the encryption setting have to match. A scan-to-email copier pointed at smtp.office365.com on port 465 just times out; switched to 587, it connects.

SMTP ports compared: 25, 465, 587 and 2525

SMTP ports are the numbered entries on a mail server where the hand-over of an email starts. SMTP (Simple Mail Transfer Protocol) is the set of commands spoken once that connection opens.

A mail server often listens on several SMTP ports: in our connection test, smtp.gmail.com answered on 25, 465 and 587.

Port	Encryption	What it is for	Sign-in	Use it when
587	STARTTLS: starts in plain text, then switches to TLS	Message submission, a device or app handing mail to its provider	Required	Your default for forms, printers, plugins and apps
465	Implicit TLS: encrypted from the first byte	Message submission over TLS	Required	Your provider lists it, or the device offers only SSL (the name of TLS's predecessor). Not on Microsoft 365
25	STARTTLS if both sides offer it	Relay between mail servers, and delivery to a domain's MX (mail exchange) servers	Usually none	Only when your provider's setup asks for it, such as a relay connector
2525	Set by the provider	No standard email role	Set by the provider	Only if your sending service documents it

Port 2525 is not an email standard: the IANA (Internet Assigned Numbers Authority) port registry lists it for a service called ms-v-worlds. Some sending services listen on it as a spare for networks that block 587.

Port 587 vs 465: STARTTLS or implicit TLS

Ports 587 and 465 do the same job with the same TLS encryption. They differ only in when it starts.

On 587 the device connects in plain text, sees the server offer STARTTLS, sends that command and switches to TLS. That upgrade is set out in Request for Comments (RFC) 3207, one of the internet's numbered standards.

On 465 the TLS handshake comes first, before any email command is sent.

Neither one is the legacy option. Port 465 was briefly registered as "smtps", then revoked and handed to another service.

In 2018, RFC 8314 registered it again for message submission over TLS. Guides that still call 465 deprecated are out of date.

RFC 8314 prefers implicit TLS over STARTTLS. It finds no real security difference, though, as long as both ends refuse to send without TLS. Pick whichever your provider documents.

Device menus rarely say STARTTLS or implicit TLS. Google's printer setup instructions map the usual labels: SSL means port 465, and TLS means port 587.

Port 25: for mail servers, and often blocked

Of the three SMTP ports, 25 is the only one that works between mail servers (RFC 5321).

To deliver a message, your provider looks up the recipient domain's MX record and connects on 25. An MX record has no way to name another port.

RFC 6409, the current version of a 1998 standard, keeps that relay work apart from message submission. A device handing over new mail uses 587 and has to sign in. Servers relaying mail between domains stay on 25, with no password.

That missing sign-in is why networks restrict port 25. Infected computers used it to send spam straight to other servers.

M3AAWG, an industry anti-abuse working group, tells network providers to block 25 except for approved mail servers. The same document asks them to keep 465 and 587 open (M3AAWG, updated August 2023).

Cloud platforms follow the same rule. Amazon EC2 blocks port 25 to public addresses by default (Amazon EC2 documentation), and Google Compute Engine blocks connections to external port 25 (Google Cloud).

Azure blocks it on most subscription types (Microsoft Learn). A contact form on a cloud server set to 25 times out, while 587 goes through.

A few setups use 25 by design: Microsoft 365's Direct Send and relay connectors, and Google's restricted server for Workspace. In each, list the device's IP (internet protocol) address in your SPF record, or its mail may be rejected or marked as spam.

SMTP ports and settings for Gmail and Google Workspace

Google offers three ways for a printer, scanner or app to send through Gmail, set out on Google's Workspace page for printers and apps (updated 22 October 2026). Google calls SMTP relay the recommended and most secure of them. A personal Gmail account can use only the first; the other two need a Workspace administrator.

Option	Server	Port	Sign-in	Can send to
Gmail SMTP server	smtp.gmail.com	465 (SSL) or 587 (TLS)	Full email address and an app password	Anyone. Workspace accounts send up to 2,000 messages a day
SMTP relay	smtp-relay.gmail.com	587 with TLS; 25, 465 or 587 without	The device's IP address, or SMTP sign-in over TLS	Anyone, up to 10,000 recipients per user a day
Restricted Gmail SMTP server	aspmx.l.google.com	25, TLS not required	None; the device's IP address is allowlisted	Gmail and Workspace users only

An ordinary account password no longer works. Since 14 March 2025, Workspace accounts have needed OAuth or an app password for SMTP, according to Google's less secure apps notice. Personal Gmail follows the same rule.

OAuth is the "Sign in with Google" kind of sign-in: the device holds a token instead of your password. A device that cannot do that needs an app password. That is a 16-digit code for one device, available only once 2-Step Verification is on (Google Account Help).

Google revokes every app password when the account password changes. A printer that stopped sending the week someone reset the password needs a fresh code, not new port settings.

SMTP ports and settings for Microsoft 365 and Outlook.com

For a device that signs in to a mailbox, Microsoft's method is client SMTP submission, also called SMTP AUTH, short for authenticated SMTP. The settings are smtp.office365.com, port 587, STARTTLS with TLS 1.2 or later, and the mailbox's sign-in (Microsoft Learn, updated 16 September 2026).

Microsoft also accepts 25 for this method but recommends 587. Each mailbox can send to 10,000 recipients a day and 30 messages a minute.

Port 465 is not an option. Microsoft says a device that defaults to 465 lacks the TLS versions it needs.

Method	Server	Port	How the device proves itself	Can send to
Client SMTP submission	smtp.office365.com	587, or 25	The mailbox's username and password, or OAuth	Anyone
SMTP relay	Your MX endpoint, such as example-co-uk.mail.protection.outlook.com	25	A static IP address or a TLS certificate on an inbound connector	Anyone
Direct Send	Your MX endpoint	25	Nothing; it is treated like mail from the internet	Your own Microsoft 365 users only

SMTP relay needs a fixed IP address or a certificate, so it suits office equipment. Microsoft does not allow it for mail from a service hosted elsewhere, such as a website on Azure.

Microsoft advises Direct Send only when a device supports none of the other methods, and is working on an option to switch it off by default.

Personal Outlook.com accounts use smtp-mail.outlook.com on port 587 with STARTTLS, and sign-in must use OAuth (Microsoft Support). For a smart device that only takes a password, Microsoft points to an app password.

SMTP AUTH and the end of password sign-in

SMTP AUTH is off in Microsoft 365 organisations set up after January 2020, and wherever security defaults are on.

An administrator can turn it on for one mailbox in the Microsoft 365 admin center. The path is Users > Active users, select the user, then Mail > Manage email apps > Authenticated SMTP (Microsoft Learn).

The bigger change is password sign-in, which Microsoft calls Basic authentication. Its revised timeline of 27 January 2026 sets these dates (Exchange Team Blog):

• Until December 2026: no change.
• End of December 2026: off by default in existing organisations; admins can switch it back on.
• New organisations after December 2026: not available by default; OAuth is the supported method.
• Second half of 2027: Microsoft announces the final removal date.

After removal, a device that signs in with a password gets "550 5.7.30 Basic authentication is not supported for Client Submission." In our test, Microsoft's server still offered AUTH LOGIN, the password method, next to XOAUTH2 for OAuth.

How to test SMTP ports from your network

Test SMTP ports from the machine that does the sending: the web server itself for a website, or a computer on the printer's network. An open port from an office connection says nothing about a web host that blocks it.

First, check that the port opens. On macOS or Linux, use nc; on Windows, use PowerShell:

nc -vz smtp.example.com 587

Test-NetConnection -ComputerName smtp.example.com -Port 587

"succeeded" or TcpTestSucceeded : True means the network lets the connection through. A timeout means something in between blocks it, or the server does not use that port.

On a Mac, nc may label 465 as "urd". IANA has a second service registered on that number; the email one is called "submissions".

Next, check what the server offers. OpenSSL comes with macOS and most Linux systems.

Connect with one of these commands, type ehlo test.example.com and press Enter. Ehlo is the opening greeting, and quit ends the session.

openssl s_client -starttls smtp -connect smtp.example.com:587 -crlf

openssl s_client -connect smtp.example.com:465 -crlf

Look for the line that starts with 250-AUTH. It lists the sign-in methods the server accepts, such as PLAIN, LOGIN or XOAUTH2, and neither step needs a password.

Here is Gmail on port 587 on 25 October 2026, shortened, with the lines we typed in place:

$ nc smtp.gmail.com 587
220 smtp.gmail.com ... gsmtp
ehlo test.example.com
250-smtp.gmail.com at your service
250-STARTTLS
mail from:<[email protected]>
530-5.7.0 Must issue a STARTTLS command first.

$ openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf -brief
Protocol version: TLSv1.3
ehlo test.example.com
250-smtp.gmail.com at your service
250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER ...

Before STARTTLS, Gmail offers no AUTH line, so nothing can sign in over a plain connection. After STARTTLS, the line appears with password and OAuth methods.

The mail from command, which sets the return path for bounces, got a 530 refusal. A printer with its encryption set to None sees the same error.

SMTP errors and what they mean

Most failures with SMTP ports trace back to a mismatch in the port, the encryption setting or the sign-in. We reproduced the first four in our own test; the rest are published by Google and Microsoft.

Message	What it means	What to change
Connection timed out	Nothing answers on that port: a firewall or host blocks it, or the server does not use it (465 on Microsoft 365)	Test the port, then use 587; on a cloud server, avoid 25
"wrong version number" or another SSL/TLS handshake error	The device starts TLS on a port that expects plain text first, such as SSL on 587	Use TLS (STARTTLS) on 587, or SSL on 465
No greeting, then the connection closes after about 10 seconds	STARTTLS chosen on 465, which expects TLS from the start	Choose SSL for 465, or move to 587
530 5.7.0 Must issue a STARTTLS command first	Encryption is off on a port that requires it	Turn on STARTTLS, often labelled TLS
534 Application-specific password required (Gmail)	2-Step Verification is on and the normal password was entered	Create an app password
535 Username and Password not accepted (Gmail)	Wrong password, or an app password revoked by a password change	Create a new app password
535 5.7.3 Authentication unsuccessful (Microsoft 365)	SMTP AUTH is off for the mailbox, or multi-factor authentication or security defaults block the password	Turn on Authenticated SMTP for that mailbox, or use OAuth
5.7.60 Client does not have permissions to send as this sender (Microsoft 365)	The From address differs from the mailbox the device signs in with	Send from the signed-in address, or grant Send As
550 5.7.30 Basic authentication is not supported for Client Submission (Microsoft 365)	Password sign-in for SMTP AUTH is switched off	Move the device to OAuth or a relay connector

Google lists its messages in its SMTP error reference, and Microsoft in its printer and scanner troubleshooting.

All of these errors happen at the hand-over, before the provider accepts the message. Once it has accepted it, a refusal from the recipient's server comes back as a bounce instead.

Do newsletters need SMTP settings?

Not when you send them from MailGraf. A website form or a copier hands each message to your mailbox provider, so it needs a server, a port and a sign-in.

A MailGraf campaign is written and sent inside the app, with no SMTP server or port to enter. The setup step is a sending domain, added under Settings > Senders.

There you either use a MailGraf domain or add DNS (Domain Name System) records for a domain you own, as Add a sending domain shows.

You still meet SMTP codes in one place: bounces. When a recipient's server refuses a campaign email, the contact's Activity tab shows the bounce code (Understand bounce codes).

The Deliverability report then separates delivery results for Gmail, Outlook, Yahoo and other providers.