Submission is not relay

SMTP is used twice on every message’s path. First when my app hands the message to my provider. Then when my provider hands it to Sara’s server. Same commands, but very different situations.

The first is submission. The second is relay. Keeping them apart explains the three port numbers you keep seeing in mail settings.

The three ports

Port 587 is for submission. Your mail app connects here, upgrades to TLS with STARTTLS, and logs in with your password or token.

Port 465 is also submission, with one difference: TLS starts immediately, before any SMTP command. There’s no STARTTLS step because the connection is encrypted from the first byte. This is called implicit TLS.

Port 25 is for relay between mail servers. No password. The receiving server accepts or refuses based on whether it’s responsible for the destination domain, and on its anti-spam policy.

Here are the three sequences side by side:

587: TCP -> EHLO -> STARTTLS -> TLS -> EHLO -> AUTH -> MAIL
465: TCP -> TLS -> EHLO -> AUTH -> MAIL
25:  TCP -> EHLO -> MAIL -> RCPT -> DATA

Don’t describe 465 as “server-to-server SMTP”. It’s submission. And don’t confuse it with STARTTLS, which upgrades a connection that’s already open.

Why submission has more rules

Submission happens inside an account. My provider knows who I am, so it can enforce things a relay can’t. It can require login, check that I’m allowed to use [email protected] as the sender, add a missing Date or Message-ID header, and rate-limit me if I send 10,000 messages in a minute.

Relay on port 25 starts from a stranger’s server. There’s no account. The receiving MTA only asks “is this for one of my domains, and does this sender look legitimate?”.

The port doesn’t create trust

Connecting to 587 doesn’t make anything safe by itself. Three separate things do:

• certificate validation proves you’re talking to the real smtp.fastmail.com
• authentication proves which account is sending
• authorization decides which sender addresses that account may use

A mistake I see often

Someone configures their app to send through port 25 because “it connected fine”. Then it works at home and fails at a coffee shop, because most networks block outbound 25 to stop spam bots. Or it works until the receiving server tightens policy and starts answering 550 5.7.1 Relay access denied.

Use 587 or 465 with credentials. Port 25 is for servers talking to servers.

Try opening your mail client’s outgoing server settings. Find the hostname, port, TLS mode, and login identity, and match the configuration to one of the three sequences above.