Port 465SMTP over TLS (SMTPS)

What port 465 is used for

Port 465 provides the same service as 587, authenticated submission of outgoing mail, with one difference: TLS wraps the connection from the moment it opens. There is no plain-text negotiation phase and therefore nothing for an attacker to strip. The same model is used by 993 for IMAP and 995 for POP3.

A confusing history

1. 1997 — Assigned to SMTPS, SMTP over SSL, and adopted by Microsoft and Netscape mail products.
2. 1998 — The IETF chose STARTTLS on 587 instead; 465 was reassigned to an unrelated protocol (URD). Many guides from this era say "465 is deprecated".
3. 2018 — RFC 8314 concluded that implicit TLS is simpler and safer, re-registered 465 as submissions and recommended it for new deployments.

Providers kept supporting 465 throughout, which is why it works almost everywhere despite two decades of conflicting advice.

Security considerations

• Implicit TLS avoids downgrade attacks that STARTTLS is theoretically exposed to.
• Certificate validation still matters. A client that accepts any certificate on 465 gains little from the encryption. Ensure the client verifies the server name.
• Same server-side hygiene as 587: authentication required, rate limits, modern TLS versions only.

How to check port 465

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :465

A line in the LISTENING state means a local program has bound port 465; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :465 or lsof -i :465.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection smtp.example.com -Port 465

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 465. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Confirm the TLS handshake and certificate:

curl -v smtps://smtp.example.com:465 --mail-from [email protected] --mail-rcpt [email protected] --upload-file NUL

Firewall considerations

Same policy as 587: inbound only on mail servers that accept submission; outbound open from client networks. Neither 465 nor 587 is affected by ISP port-25 blocking.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 465 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.