Why is port 587 preferred over port 465 in SMTP?

Question

I have recently been developing a C# client which sends emails via a SMTP server. However I have been as to what the different terms ment, like: STARTTLS/TLS/SSL... I had a faint idea of what they ment out of context, but email wise i had no clue.

Upon further investigating I found that SMTP clients communicate with servers in 2 different ways (2 encrypted ways); Explicit SSL/TLS & Implicit SSL/TLS.

From what I understand Explicit SSL/TLS is how STARTTLS works, it asks the server on an unsecured connection if TLS is supported and if it is, it continues with an encrypted connection. Implicit TLS however is secure from the begining of the connection to the end, it is never unsecure.

I might be wrong about this, please correct me if I am.

The question is why is port 587 (Explicit SSL/TLS) the preferred port over port 465 (Implicit SSL/TLS).

I know that port 465 is deprecated and I can see the usefulness of port 587 that it works both encrypted and unencrypted and its up to the client to find out what the server supports.

But I rarely see security updates which is in favor of ease of use, which is why i am confused. Why did we go from fully secure to secure only some of the way?

I hope my question makes sense.

Answer 1

Why is port 587 preferred?

Any document claiming so is historic. Today, port 465 is preferred.

The reason it used to be preferred (by some, not all operators):

• after STARTTLS was formalized, compatibility & security considerations were different
• a suitable and already used TCP port number had been reassigned by IANA

The reason we should now all prefer implicit TLS:

• unnecessary workarounds and compatibility layers added to otherwise robust security mechanisms are considered undesirable
• an alternate port usage has been assigned to resolve the port conflict
• we now have little use case left for offering optional transport security

Everyone is advised to migrate to implicit TLS. Please only send mail using secure transports. Please discourage or remove unnecessary complexity and failure modes.

Answer 2

It is currently the other way around. On the question why, RFC 8314, 3 has the reasoning:

Although this [STARTTLS] mechanism has been deployed, an alternate mechanism where TLS is negotiated immediately at connection start on a separate port (referred to in this document as "Implicit TLS") has been deployed more successfully. To encourage more widespread use of TLS and to also encourage greater consistency regarding how TLS is used, this specification now recommends the use of Implicit TLS for POP, IMAP, SMTP Submission, and all other protocols used between an MUA and an MSP.

Answer 3

SMTP uses port 25 for server-to-server communication, and port 587 for client-to-server communication.

There is no real difference in protocol here, but administrators of larger sites likely want different policies for receiving mail from other domains vs receiving mail from own customers that is likely going out to other domains, and that's why two different ports exist: it allows firewall rules to distinguish easily.

Mail servers for incoming mail do not need to verify users' credentials, ever, so they do not need to be given access to this database, while mail servers for outgoing mail need to authenticate local users, so they do need that access -- but they don't need to be reachable from everywhere in the world.

Port 465 is an SSL-only variant of port 25, but this is already handled fine with opportunistic encryption negotiated through the STARTTLS response to the EHLO command, and the STARTTLS command, which is faster than trying port 465 first, running into a timeout and then trying port 25.

Port 587 never had an SSL-only variant port assigned, and its use case is still relevant.

Server-to-server transfers use opportunistic encryption and likely fall back to unencrypted transmission if that fails -- end-to-end security is provided by encrypting the mail itself, because even with encrypted connections between servers, the mail is processed on each server.

Clients are supposed to use port 587, negotiate encryption and have a sensible policy what to do when that negotiation fails, for example it could be acceptable to continue using a challenge-response authentication method and transmit the mail unencrypted, while a password authentication scheme would become unsafe without an encryption layer below.