587/TCPSMTP Submission
Email · Well-known port · OSI layer 7
Send mail from an email client to your own server with authentication, encrypted via STARTTLS.
IANA: officially registered as submission
Look up and open a port
Port 587: SMTP submission for sending mail
Port 587 (TCP) is the submission port that mail clients and applications use to submit emails to their mail server with authentication. The tool shows you the details and generates firewall commands for it.
Built by Justin Schuessler
Try the commands on your own VPS, with root access and your own firewall.
Add multiple ports one at a time, up to 12.
Or choose a preset
Ports
Firewall rule (inbound)
Firewall commands
Open port
sudo ufw allow 587/tcpNotes on ufw
For Ubuntu and Debian. ufw creates the rule for both IPv4 and IPv6. If ufw is disabled, allow SSH first (sudo ufw allow 22/tcp), then enable it with sudo ufw enable, or you'll lock yourself out.
On a ZAP-Hosting VPS with an active network firewall, you also need to allow the port in the Customer Panel.
Port 587 explained
What is port 587 used for?
Purpose
On port 587, an email client or application submits a new email to its mail server for delivery. The client authenticates with a username and password (SMTP AUTH). The connection starts unencrypted and is upgraded to TLS using STARTTLS. Many web applications, online stores and monitoring tools send email through this port.
Origin and standard
The distinction between mail submission and mail exchange between servers was introduced in 1998 by RFC 2476. RFC 6409 now applies, and IANA lists port 587 as “submission”. This separation lets providers block port 25 for regular users without interfering with authenticated mail submission. RFC 8314 also recommends implicit TLS on port 465, though port 587 with STARTTLS remains widely used.
Typical use
- Sending from email clients such as Thunderbird, Outlook or Apple Mail
- Sending email from web applications, online stores and forums
- Notifications from monitoring systems and scripts
- Submitting mail to an external delivery service using login credentials
Security
Require STARTTLS on port 587 before clients can authenticate, or passwords will be sent in plain text. Only accept mail from authenticated users on this port so it cannot become a relay for spammers. Protect authentication against password attacks, for example with Fail2ban and rate limiting. Otherwise, hijacked accounts can send spam through your server, putting your IP on blocklists.
More ports
Related ports
These ports are often part of the same setup. Click one to see its explanation and firewall commands.
View all well-known ports and the complete IANA list
Port list source: IANA Service Name and Transport Protocol Port Number Registry, as of October 22, 2026. iana.org
Discover more
More tools
Subnet Calculator
Calculate the network address, broadcast address, subnet mask, and usable host range from a CIDR address, and convert between CIDR and IP ranges (IPv4 and IPv6).
Built by Jakub Martyniak
OSI model
NewInteractively learn the 7 layers of the OSI model: click layers, assign terms such as switch, ARP, or port 443, and explore animated encapsulation, a quiz, and a cheat sheet for the IHK exam.
Built by Justin Schuessler
TCP/IP model
NewInteractively learn the 4 layers of the TCP/IP model (DoD model) according to RFC 1122, with OSI model mapping, animated encapsulation, a port quiz, and a cheat sheet.
Built by Justin Schuessler
Port Checker
Check whether specific ports are open on an IP or hostname—select a protocol or game instead of scanning all ports at once.
Built by Sebastian Rademacher
FAQ
Frequently asked questions
Quick answers about port 587.
Both are used to send mail with authentication. Port 465 uses implicit TLS, so the connection is encrypted from the start, and is recommended by RFC 8314. Port 587 uses STARTTLS and is just as common. Use the port specified by your mail provider.
Port 25 is intended for mail exchange between mail servers. Port 587 is for mail clients and applications that authenticate with login credentials and submit mail for delivery. That is why port 587 is often open when port 25 is blocked.
With firewalld, run sudo firewall-cmd --permanent --add-port=587/tcp followed by sudo firewall-cmd --reload. With ufw, sudo ufw allow 587/tcp is enough. You only need to open the port for incoming traffic on your mail server; the default rule usually allows outgoing mail.
The connection starts unencrypted and switches to TLS using STARTTLS. A properly configured server only allows authentication after STARTTLS. Make sure your mail client requires STARTTLS.
Any more questions?
Contact SupportYour own server?
Try the commands on your own VPS
With a ZAP-Hosting VPS, you have root access, can set up services and firewall rules yourself, and can immediately see which ports are open.
4.4/5 Trustpilot32,000+ Active serversSince 2010
No setup. No risk. Online in seconds.
Flexible TermCancel anytimeOnline in 60 seconds
Looking for more tools? View all network tools