Port reference
Port 587 (TCP) – SMTP Submission
SMTP submission — authenticated outbound mail, upgraded to TLS via STARTTLS.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- Low
Lower risk, but still expose it only when you actually need it.
Default state
Open on mail servers accepting client submission. Typically exposed to the internet for authenticated users to send mail.
What is port 587 used for?
Port 587 is the standard port for sending email. When you set up an account in a mail client like Outlook, Thunderbird, or Apple Mail, this is the port used to submit your outgoing messages to the mail server, which then delivers them on. The connection starts in plaintext and upgrades to encryption with STARTTLS, and it always requires you to log in. Mail servers such as Postfix and Exim listen here for authenticated submission.
When would you open it?
You only open port 587 if you run your own mail server and want clients to send outgoing mail through it. Most people never need to: their provider already handles it. If you host Postfix or Exim for a domain, you forward 587 so your users can submit mail from anywhere.
Is it safe to open?
It is reasonably safe as long as you require authentication and enforce TLS via STARTTLS, since the main risks are credential guessing and relay abuse. See the security notes below.
How to check if this port is open
ss -tulpn | grep :587
nmap -p 587 <target>netstat -ano | findstr :587
Test-NetConnection <host> -Port 587lsof -i :587
nmap -p 587 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 587 to your device's local IP, internal port 587, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 587/tcpsudo firewall-cmd --permanent --add-port=587/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 587 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 587" -Direction Inbound -Protocol TCP -LocalPort 587 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against SMTP AUTH
- Open-relay abuse from missing/misconfigured authentication
- STARTTLS stripping / downgrade to cleartext
- Spam and phishing relay via compromised accounts
Hardening
- Require SMTP AUTH on 587 and reject unauthenticated relay
- Make STARTTLS mandatory and reject plaintext logins
- Enforce TLS 1.2/1.3 and disable weak ciphers
- Rate-limit, lock out brute force, and monitor send volumes
- Enforce SPF/DKIM/DMARC and use strong, unique credentials
How to block this port
sudo ufw deny 587/tcpsudo firewall-cmd --permanent --remove-port=587/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 587 -j DROPNew-NetFirewallRule -DisplayName "Block 587" -Direction Inbound -Protocol TCP -LocalPort 587 -Action Blocknmap snippet
nmap -p587 --script smtp-commands,smtp-open-relay,smtp-enum-users,ssl-enum-ciphers <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 587 and 465?
- Port 587 starts in cleartext and upgrades to encryption with STARTTLS; port 465 uses implicit TLS from connect. Both are submission ports that require authentication.
- Why use port 587 instead of port 25?
- Port 25 is for server-to-server relay and is widely blocked for client sending. Port 587 is the dedicated submission port for authenticated users, with mandatory STARTTLS.