Port 25, 587 and 465
Three ports, three purposes. Using the wrong one is behind a large share of mail problems.
What each port is for
- 25 — server to server
- How mail servers hand mail to each other. No authentication, opportunistic TLS. Only your mail server should use it.
- 587 — submission
- How your users hand mail to your server. Authentication required, STARTTLS. This is what mail clients should be configured with.
- 465 — implicit TLS submission
- The same as 587 but encrypted from the first byte. Fine, and preferable where clients support it.
Configuring users on port 25 is the classic mistake: it works at first, then fails the moment anything tightens, and it makes authenticated and unauthenticated traffic indistinguishable in your logs.
Why port 25 is treated carefully everywhere
Outbound port 25 from a compromised machine is how spam reaches the internet. Nearly every provider therefore watches it, and many block it by default. It is not a view of you; it is how the whole industry limits the damage when a customer's machine is taken over.
The consequence of getting it wrong is not a warning, it is a blocklist entry that affects your address and your neighbours' reputation.
What we expect
Tell us before you start sending. It takes one ticket. We check that the address has no history attached, and a sudden rise in port 25 traffic is then known rather than investigated as an incident.
Before you send a single message, have all four records right — SPF, DKIM, DMARC and a matching PTR. See sending mail from your server and reverse DNS. A server sending without them is indistinguishable from a compromised one.
Never run an open relay
A mail server that accepts mail from anyone and sends it anywhere is found within hours. Require authentication on 587 and 465, restrict 25 to inbound mail for your own domains, and test from outside after every change.
Rate-limit per authenticated account as well. One stolen mailbox password should produce a few hundred messages and an alert, not fifty thousand and a blocklisting.
Warm up gradually
A new address with no sending history that suddenly emits ten thousand messages
looks exactly like a compromise to every receiving system. Start small, grow over
weeks, keep complaint rates low, and watch your queue —
postqueue -p is the earliest warning you will get that something is
wrong.
If mail is not your business
Use a relay. Your application authenticates to a dedicated sending service on 587, and someone else maintains the reputation. That is a perfectly respectable engineering decision, and for most applications sending transactional mail it is the right one — see building your own mail server.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base