SMTP ports 25, 465, 587 and 2525: which one to use

To send email from an app or a mail client, use port 465 (TLS from the start) or port 587 (STARTTLS), with a username and password. Port 25 is for mail servers delivering to each other, and most cloud hosts block or throttle it. Port 2525 is an unofficial fallback that some email providers offer when 587 is blocked. And if your provider has an HTTPS API, you can skip SMTP ports entirely and send over port 443.

SMTP ports at a glance

Port 25: server to server

Port 25 is SMTP's original port. Today it's how mail servers deliver to each other: your provider's server connects to the recipient's mail server on port 25 and hands the message over. That step doesn't use a login, because the receiving server accepts mail for its own users from anyone.

That's also why it's blocked. Malware on home computers and hijacked servers used to send spam straight to recipients on port 25, so internet providers and cloud hosts now block or throttle outbound connections to it. Here's what the major hosts say in their own docs (checked November 2026):

You only need port 25 if you run your own mail server that delivers directly to recipients. For an app, that's rarely worth it: you'd need to manage IP reputation, DNS records and bounce handling yourself, and mail from a new server on a cloud IP often goes straight to spam.

Port 587: the standard submission port

Port 587 is for submitting mail: your app or mail client hands a message to your email provider, and the provider delivers it on port 25. RFC 6409 defines it, and almost every provider supports it.

The connection starts unencrypted. The client sends STARTTLS, the two sides switch to TLS, and only then does the client log in and send the message. That upgrade step is where the risk is: if your client is happy to carry on without TLS when the upgrade fails, someone on the network can strip the STARTTLS offer and read your password. Make sure your client requires TLS on 587. In Nodemailer that's requireTLS: true.

Port 465: TLS from the start

On port 465 the connection is encrypted from the first byte, like HTTPS. There's no unencrypted phase and nothing to strip.

Older guides call 465 deprecated. It was assigned for SMTP over SSL in the late 1990s and then withdrawn, but RFC 8314 (2018) registered it again for mail submission and recommends implicit TLS over STARTTLS. So if your provider supports both, 465 is the better choice. 587 with TLS required is also fine.

In settings screens, "SSL" usually means port 465 and "TLS" or "STARTTLS" usually means 587. The labels are historical: both use modern TLS.

Port 2525: the unofficial fallback

Port 2525 isn't registered for SMTP. Many email providers listen on it anyway, as a copy of 587, because some networks block the standard ports. If 587 and 465 time out from your server and your provider documents 2525, try it. Some providers use other numbers for the same purpose; Amazon SES, for example, also listens on 2587 and 2465.

Ports for receiving mail

These come up in the same settings screens but have nothing to do with sending. Your app only needs them if it reads a mailbox.

Which port should you use?

1. Writing code, and your provider has an HTTPS API? Use the API on port 443. No port to unblock, and you get a message ID back.
2. The software only speaks SMTP (a WordPress plugin, a self-hosted app, a printer)? Use 465 if your provider supports it, otherwise 587 with TLS required.
3. Both time out from your server? Your host probably blocks them. Try 2525 if your provider offers it, or switch to an HTTPS API.
4. Never port 25 for sending from an app to a provider.

How to test an SMTP port

Check whether you can reach the port at all. A timeout usually means something between you and the server is blocking it; "connection refused" means the server isn't listening on that port.

nc -vz smtp.example.com 587

To see the server's greeting, connect with OpenSSL. Port 465 uses TLS straight away, and port 587 needs -starttls smtp.

openssl s_client -connect smtp.example.com:465 -crlf -quiet
openssl s_client -connect smtp.example.com:587 -starttls smtp -crlf -quiet

A working server replies with a line starting 220. Type EHLO test to see what it supports, such as AUTH PLAIN LOGIN, then QUIT.

Skipping SMTP: sending over HTTPS

An email API takes the message as JSON over HTTPS on port 443, which hosts don't block. That solves the port problem, and it changes a few other things:

• One request per email. SMTP is a conversation of several round trips over a connection you have to open and close. On serverless platforms, where every function call may start fresh, a single HTTPS request is faster and simpler.
• You get something back. The API returns an ID for each message, so you can look up whether it was delivered or bounced, or get a webhook when it happens. SMTP tells you the provider accepted the message and nothing after that.
• API keys instead of a mailbox password. Keys can be scoped to sending only and revoked one at a time.

SMTP is still the right choice for software that can't make API calls, and some providers offer both. Sendaro is API only: there's no SMTP server, so it fits code you write rather than off-the-shelf software. Here's the same email both ways in Node.js:

// SMTP with Nodemailer: a host, a port, a TLS mode and a password.
import nodemailer from "nodemailer";

const transporter = nodemailer.createTransport({
  host: "smtp.example.com",
  port: 465,
  secure: true, // implicit TLS. On port 587: secure: false, requireTLS: true
  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
});

await transporter.sendMail({
  from: "Acme <hello@mail.example.com>",
  to: "user@example.com",
  subject: "Welcome to Acme",
  html: "<p>Thanks for signing up.</p>",
});

// An HTTPS API: one request on port 443.
import { Sendaro } from "sendaro";

const sendaro = new Sendaro(); // reads SENDARO_API_KEY

const { id } = await sendaro.send({
  from: "Acme <hello@mail.example.com>",
  to: "user@example.com",
  subject: "Welcome to Acme",
  html: "<p>Thanks for signing up.</p>",
});

// Later: the status and event history for that email.
const email = await sendaro.get(id);

The Node.js guide walks through it from domain setup to delivery status.

Questions

Is port 465 deprecated?

No. It was withdrawn for a while in the late 1990s, which is where the idea comes from, but RFC 8314 registered it again in 2018 for mail submission over TLS and recommends it.

Why is port 25 blocked?

Because spam from infected computers and hijacked servers was sent directly on port 25. Blocking it outbound on home connections and cloud servers cuts that off. Legitimate apps send through a provider on 587, 465 or an HTTPS API instead.

What SMTP port does Gmail use?

smtp.gmail.com accepts mail on port 465 (SSL) and 587 (TLS or STARTTLS). Both need your Google account to sign in, usually with an app password.

What's the difference between SSL and TLS in SMTP settings?

In practice it's the port and when encryption starts. "SSL" usually means port 465, encrypted from the start. "TLS" or "STARTTLS" usually means port 587, where the connection is upgraded after it opens. Both use TLS today; SSL itself is long obsolete.

What port does an email API use?

Port 443, the same as any HTTPS website. That's why an API works on hosts that block every SMTP port.