STARTTLS vs implicit TLS: which port should you use?

Three ports show up whenever you configure an SMTP client: 587, 465 and 2525. They are not interchangeable, and picking the wrong one is the most common reason a send silently fails.

Port 587, submission with STARTTLS

This is the modern default. The connection opens in cleartext, the client issues STARTTLS, and the session upgrades to TLS before any credentials are sent. Use this unless you have a specific reason not to.

Port 465, implicit TLS

Here TLS is negotiated immediately, before any SMTP command. Once deprecated, it was re-blessed by RFC 8314 and is a fine choice, especially for clients that handle implicit TLS more reliably than STARTTLS.

Port 2525, the fallback

Many networks and cloud providers block outbound 25 and sometimes 587. Port 2525 is a widely supported alternative that behaves like 587 with STARTTLS. Reach for it when a firewall is in the way.

What about cleartext auth?

Some legacy relays, MailEnable smarthosts among them, cannot negotiate TLS to a downstream. For those, BookMySpot exposes a plaintext-auth submission port so the relay can hand mail off without TLS, while everything onward to the internet is still encrypted and DKIM-signed. Use it only on a trusted network segment.