Port 587SMTP submission

What port 587 is used for

Port 587 separates submission (a user handing a new message to their own mail provider) from relay (servers passing mail between domains on port 25). The separation, defined in RFC 6409, lets providers apply different rules to each: submission requires authentication and can enforce policies on the sender, while port 25 must accept mail from any server on the internet.

Typical outgoing-mail settings:

How STARTTLS works on 587

The client connects in plain text, the server lists its capabilities, the client issues STARTTLS, and both sides negotiate TLS before any credentials are sent. If the upgrade fails, a correctly configured client refuses to continue rather than sending the password in clear text. Check that "require TLS" is set in the client; some older clients treat STARTTLS as optional.

Security considerations

• Require authentication and TLS on the server. Unauthenticated submission on 587 is an open relay.
• Rate-limit per account. A compromised mailbox used to send spam is the most common submission-port abuse.
• Prefer OAuth or app passwords with providers that support them, so a leaked device password does not expose the main account.
• Watch for password-guessing against 587; it attracts the same credential attacks as webmail logins.

How to check port 587

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :587

A line in the LISTENING state means a local program has bound port 587; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :587 or lsof -i :587.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection smtp.example.com -Port 587

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 587. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

See the server's capabilities, including whether it advertises STARTTLS:

curl -v smtp://smtp.example.com:587 --mail-from [email protected] --mail-rcpt [email protected] --upload-file NUL

The verbose output shows the EHLO response with 250-STARTTLS when the upgrade is offered.

Firewall considerations

Mail servers that accept submission need inbound 587 from wherever users connect, often the whole internet. Workstations need nothing inbound. Outbound 587 should remain open on client networks so mail apps work; it is not subject to the ISP blocks that affect port 25.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 587 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.