DevToolsmith

Port 587: SMTP submission

Port 587 (TCP) is the standard port for sending email from apps and mail clients. It is a well-known port (0–1023). On Linux and macOS, binding to it needs root or the CAP_NET_BIND_SERVICE capability.

Service
SMTP submission
Protocol
TCP
Range
Well-known (0–1023)
Official
IANA-registered
Exposure
Meant to be public
Category
Email

What uses port 587

Applications, websites and email clients should send mail through port 587 with authentication (username and password or an API key), upgrading the connection with STARTTLS. Email services like Amazon SES, SendGrid, Mailgun, Postmark, Gmail and Microsoft 365 all accept submission on 587. Unlike port 25, it is rarely blocked by cloud providers.

Should port 587 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

  • “Must issue a STARTTLS command first” means the client tried to authenticate before encrypting. Enable STARTTLS/TLS in the mail library settings.

Check what is listening on port 587

Linux
sudo ss -ltnp 'sport = :587'
macOS
sudo lsof -nP -iTCP:587 -sTCP:LISTEN
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 587 -State Listen
netstat -ano | findstr :587

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 587

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux
sudo kill $(sudo lsof -t -iTCP:587 -sTCP:LISTEN)
Windows (PowerShell)
Stop-Process -Id (Get-NetTCPConnection -LocalPort 587 -State Listen).OwningProcess

Open port 587 in the firewall

Ubuntu / Debian (ufw)
sudo ufw allow 587/tcp
# Close it again:
sudo ufw delete allow 587/tcp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-port=587/tcp
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "SMTP submission 587/TCP" -Direction Inbound -Protocol TCP -LocalPort 587 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 587 from another machine

macOS / Linux
nc -zv example.com 587
Windows (PowerShell)
Test-NetConnection example.com -Port 587

Related ports

  • Port 465 (SMTPS): used for email submission over implicit TLS (SMTPS).
  • Port 25 (SMTP): used by SMTP for delivering email between mail servers.
  • Port 143 (IMAP): used by IMAP for reading email that stays on the server.

More email ports

110 (POP3) , 993 (IMAPS) , 995 (POP3S) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 587 used for?

Port 587 is the standard port for sending email from apps and mail clients. Applications, websites and email clients should send mail through port 587 with authentication (username and password or an API key), upgrading the connection with STARTTLS. Email services like Amazon SES, SendGrid, Mailgun, Postmark, Gmail and Microsoft 365 all accept submission on 587. Unlike port 25, it is rarely blocked by cloud providers.

Is it safe to open port 587?

This port is meant to be reachable by clients on the internet when you run this service publicly. Keep the service behind it up to date and require authentication where it applies.

How do I check if port 587 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :587'" on Linux or "sudo lsof -nP -i :587" on macOS. From another machine, run "nc -zv host 587" or, on Windows, "Test-NetConnection host -Port 587". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.