Port 587 SMTP submission – Free, Online, Private

What listens on 587

Port 587 is message submission. The IANA name is submission, RFC 6409. A mail client connects, issues EHLO, starts TLS, and authenticates before the server will relay. The greeting is cleartext SMTP until STARTTLS. Implicit TLS is 465, submissions. Delivery between mail servers is 25, smtp. A user laptop that cannot open 25, because the network blocks it, is supposed to use 587. A server that accepts unauthenticated relay on 587 is misconfigured in the same way as an open relay on 25.

The IANA service name is submission: Message Submission. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 587. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 587

Service notes for port 587: the IANA name is submission (Message Submission), and the program people mean is SMTP submission. TCP 587 is the IANA submission port. Authenticated users send mail here and upgrade with STARTTLS. Server-to-server mail stays on 25. Require STARTTLS before AUTH, and require AUTH before relay. The certificate name has to match. A submission port that still offers LOGIN in cleartext will be used by a client that does not bother to upgrade. Disable that. Rate-limit authentication failures. A compromised mailbox password becomes a spam source on 587 as easily as on 25, and the messages are authenticated, so other servers will trust them more. Lock the account. Do not leave a test user. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 587, you are on the wrong page.

Applications that hard-code port 25 fail on networks and cloud hosts that block it. Point them at 587 with credentials. A client set to SSL on 587 speaks TLS to a cleartext banner and fails. Choose STARTTLS for 587. A firewall that opened 25 for the MX and not 587 blocks every user agent. Another trap is a submission daemon bound to localhost only, which is correct for a web app on the same machine and wrong for a phone on a cellular network.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 587 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. TCP 587 should answer with an SMTP banner, 220. The EHLO response should advertise STARTTLS. nc shows the banner. It does not test the login. Confirm the listen address is the one clients use.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• 587 is submission, not MX delivery. Do not point an MX record's expectation at it.
• Implicit TLS is 465. STARTTLS is 587.
• An open 587 with no auth is an open relay.
• UDP 587 is in the registry and is not submission.

Linuxsudo ss -lptn 'sport = :587'
sudo lsof -nP -iTCP:587 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:587 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.587[^0-9]'

Windowsnetstat -ano | findstr :587
Get-NetTCPConnection -LocalPort 587

Remotenc -vz host 587