Submission is not relay

Mail submission and server-to-server relay both use SMTP commands, but they have different trust and policy boundaries.

Port 587 is reserved for message submission. Clients normally authenticate there. Port 25 is the standard path for SMTP relay between mail servers, where the receiving server decides whether it is responsible for the destination domain.

Port 465 is the TLS-first submission service: the TLS handshake begins immediately. Do not describe 465 as server-to-server SMTP or confuse it with STARTTLS on an already-open connection.

Submission starts inside an account boundary. The MSA can require authentication, enforce which sender addresses the account may use, add missing fields, and apply rate limits. Relay on port 25 starts from another mail system and uses domain responsibility and anti-abuse policy instead of an end-user password.

587: TCP -> EHLO -> STARTTLS -> TLS -> EHLO -> AUTH -> MAIL
465: TCP -> TLS -> EHLO -> AUTH -> MAIL
25:  TCP -> EHLO -> MAIL -> RCPT -> DATA

The port does not create trust by itself. Certificate validation protects the server identity, authentication identifies the submitting account, and authorization decides which envelope senders and recipients that account may use.

Do not configure a user agent to submit through port 25 just because a connection succeeds. Networks often block it, and receiving MTAs should not behave like open submission services.

Capture the settings screen of a mail client without secrets. Identify the submission hostname, port, TLS mode, authentication identity, and whether the configuration matches one of the sequences above.