Port reference
Port 465 (TCP) – SMTPS
SMTPS — authenticated mail submission wrapped in implicit TLS from connect.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- Low
Lower risk, but still expose it only when you actually need it.
Default state
Open on mail servers offering implicit-TLS submission. Usually exposed to the internet for authenticated clients to send mail.
What is port 465 used for?
Port 465 is SMTPS, the port mail clients use to send outgoing email over an encrypted, authenticated connection. Unlike STARTTLS on port 587, the connection is encrypted from the moment it opens, with no cleartext phase. Email apps like Outlook, Thunderbird, and Apple Mail use it to hand your messages to your provider's mail server, and most providers list it as the recommended outgoing (SMTP) port.
When would you open it?
You would open port 465 on a mail server so that authenticated users can send email through it. If you only use a hosted provider like Gmail or your ISP, you do not need to open anything. Expose it only if you run your own outgoing mail server.
Is it safe to open?
It is safe when you require login plus TLS and never relay mail without authentication, otherwise it can be abused to send spam in your name. See the security notes below.
How to check if this port is open
ss -tulpn | grep :465
nmap -p 465 <target>netstat -ano | findstr :465
Test-NetConnection <host> -Port 465lsof -i :465
nmap -p 465 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 465 to your device's local IP, internal port 465, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 465/tcpsudo firewall-cmd --permanent --add-port=465/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 465 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 465" -Direction Inbound -Protocol TCP -LocalPort 465 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against SMTP AUTH
- Open-relay abuse when authentication or relay rules are misconfigured
- Weak/deprecated TLS exploitation
- Spam and phishing relay through compromised accounts
Hardening
- Require SMTP AUTH over TLS for all submission; never relay unauthenticated
- Enforce TLS 1.2/1.3 and disable weak ciphers and old protocols
- Rate-limit, lock out brute force, and alert on credential abuse
- Verify the server is not an open relay and enforce SPF/DKIM/DMARC
- Use strong, unique account passwords and consider MFA on webmail
How to block this port
sudo ufw deny 465/tcpsudo firewall-cmd --permanent --remove-port=465/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 465 -j DROPNew-NetFirewallRule -DisplayName "Block 465" -Direction Inbound -Protocol TCP -LocalPort 465 -Action Blocknmap snippet
nmap -p465 --script smtp-commands,smtp-open-relay,ssl-enum-ciphers,ssl-cert <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 465 and 587?
- Port 465 uses implicit TLS — the session is encrypted from connect. Port 587 starts in cleartext and upgrades via STARTTLS. Both require authentication and should enforce TLS.
- Is port 465 still recommended?
- Yes. RFC 8314 reinstated 465 as the preferred port for implicit-TLS message submission. Use it (or 587 with mandatory STARTTLS) and require authentication.