Four ports come up whenever an application needs to send mail: 25, 465, 587, and 2525. Two of them are submission standards, 587 and 465, and the advice most often repeated about 465 has been out of date since 2018. Port 25 is not for submission at all, and 2525 is a convention with no standard behind it.
The short answer: use 587 with STARTTLS. Use 465 if your client is happier opening a TLS connection directly. Use 2525 if something on your network blocks 587. Do not use 25 to submit mail from an application.
What does each port actually do?
The ports differ on two axes: whether they are meant for submission or relay, and when in the connection encryption starts.
- 25 is the relay port. It is how one mail server hands a message to another. It predates authenticated submission and carries no expectation of either.
- 587 is the submission port, defined for that purpose by RFC 6409. The connection opens in plaintext and upgrades to TLS with the
STARTTLScommand before credentials are sent. - 465 is the implicit-TLS submission port. The TLS handshake happens first and the entire SMTP dialogue runs inside it, so nothing is ever sent in the clear. Libraries usually label this "SSL/TLS" or "SMTPS".
- 2525 has no standard assigning it to SMTP at all. Providers offer it as an alternative to 587 for networks that block the standard port.
The distinction between 465 and 587 is about when TLS starts rather than how strong it is. On 465 the connection is encrypted from the first byte. On 587 it becomes encrypted a round trip later, and a correctly configured server refuses AUTH until it does.
Is port 465 deprecated?
No, and this is the single most common piece of stale SMTP advice.
The history is genuinely confusing. Port 465 was assigned for SMTP over TLS early on, then withdrawn in favour of the STARTTLS approach on 587, which is where the "465 is deprecated" advice comes from. That advice was correct for a period. Then RFC 8314, published in January 2018, recommended implicit TLS for mail submission and re-established 465 as the port for it, under the service name submissions.
So a page telling you 465 is obsolete is describing the state of things before 2018. Both 465 and 587 are current. Pick the one your client supports most cleanly, and prefer 465 if you would rather not depend on a plaintext-to-TLS upgrade at all.
Why is port 25 blocked, and how do I check?
Outbound port 25 is blocked by many consumer ISPs and by cloud and hosting providers, because an unauthenticated relay port on a compromised machine is how bulk spam gets sent. Whether the block can be lifted depends on who set it. A consumer ISP generally will not lift it for a residential line, while cloud providers vary: some accept a removal request, and at least one offers no exemption at all. Check the policy your own provider publishes rather than assuming either way.
You can confirm a block by opening a connection to a known mail server on port 25 and seeing whether you get a 220 greeting or a timeout. A manual session is the clearest way to see it, and checking an SMTP connection with a telnet session walks through one.
If port 25 is blocked, that is not the problem to solve. An application should be submitting on 587 or 465 regardless.
What is the difference between submission and relaying?
Submission is a mail client or application handing a new message to a server it has authenticated to. Relaying is a server passing an existing message towards its destination.
The difference decides which port and which rules apply. Submission requires authentication, allows the server to fix up and sign the message on its way out, and happens on 587 or 465. Relaying happens on 25, between servers, and is what the receiving side's spam and reputation systems judge.
An application sending its own mail is always doing submission. If you are configuring something and reaching for port 25, the configuration is describing the wrong half of the system.
Which ports does Bird accept?
Three, and port 25 is deliberately not among them:
| Port | Encryption |
|---|---|
| 465 | Implicit TLS (SMTPS) |
| 587 | STARTTLS |
| 2525 | STARTTLS |
On 587 and 2525, AUTH is refused until STARTTLS has run, so credentials never travel in the clear on any of the three. Port 25 is not offered for submission.
The host depends on your key's region, which is the prefix in the key itself: a bk_eu1_... key sends through eu1.smtp.bird.com, a bk_us1_... key through us1.smtp.bird.com. Authentication uses your normal API key rather than a separate SMTP credential: the username is the literal string bird and the password is the key.
Mail submitted over SMTP is treated exactly like mail sent through the email API, with the same domain verification, DKIM signing, suppression handling, tracking, and events. Send email over SMTP has the full connection reference, two annotated sessions, one on 465 and one shared by 587 and 2525, and the per-key defaults that shape a send.
How do I find the port my client is using?
Where to look depends on the software, and the pattern is consistent:
- Application frameworks put it in mail configuration, usually next to the host, as a
portorMAIL_PORTsetting. - Content-management systems expose it in an SMTP plugin's settings page alongside an encryption dropdown. That dropdown is the setting people get wrong: "SSL/TLS" means 465 and "STARTTLS" means 587 or 2525, and mismatching the two produces a connection that hangs or is refused rather than a useful error.
- Devices such as printers and scanners keep it under a notification or scan-to-email screen.
If mail is failing and you suspect the port, test the connection directly before changing application code. A manual session tells you whether the port is reachable, whether TLS negotiates, and whether authentication is accepted, which separates a network block from a credential problem.