What is the difference between secure submission (587) and relay (25)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You've probably seen "port 587" and "port 25" in your SMTP settings and wondered what the difference is. Here's the short version: Port 587 is for you sending email (authenticated submission). Port 25 is for mail servers talking to each other (relay).
Port 25 came first. It's the original email port, designed for mail servers to pass messages between each other. When you send an email, your server uses port 25 to hand it off to the recipient's server. No authentication required (historically). This worked fine when the internet was small and trusted.
Then spam happened. Spammers loved port 25 because they could blast email directly from infected home computers without authenticating. ISPs started blocking outbound port 25 from residential connections to stop this. That's why if you try to send email through port 25 from your laptop at a coffee shop, it won't work.
Port 587 was created specifically for authenticated submission. When you configure Mailchimp, SendGrid, or any ESP in your app, you're using port 587. It requires you to log in with credentials before it accepts your email. Modern email clients (Gmail, Outlook, Apple Mail) default to port 587 for outgoing mail.
The practical difference: Port 25 is server-to-server, no authentication, often blocked by ISPs. Port 587 is you-to-server, requires authentication, works everywhere. If you're configuring SMTP settings for an application or email client, use 587. If you're running a mail server that receives email from other mail servers, you'll listen on 25.
One more thing: port 587 should use STARTTLS encryption. Port 25 historically didn't require encryption (though modern servers use it when available). Some providers also use port 465 for SMTPS (SMTP wrapped in TLS from the start), but 587 with STARTTLS is the current standard.
And if you're stuck configuring this, check your ESP's documentation or ask our SOS hotline. Wrong port = emails don't send, and that's a quick fix once you know which one to use.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
