Use the port that matches the handshake your host requires. Port 465 is implicit TLS: the TLS handshake starts before any SMTP banner. Port 587 is message submission that starts in cleartext and upgrades with STARTTLS. Neither port is deprecated. A client that uses the wrong handshake on the right port times out or never sees a 220 banner. Arawa Mail documents mailbox clients on port 465 with SSL/TLS only.
Which port should a new client use?
Match the provider. RFC 8314 prefers implicit TLS on 465 as the long-term direction and still expects both 465 and 587 during the transition. RFC 6409 defines 587 as the submission port. A host that documents only one mode will reject the other even if your firewall is open.
| Port 465 (submissions) | Port 587 (submission) | |
|---|---|---|
| First bytes | TLS ClientHello | Cleartext SMTP, then STARTTLS |
| Client setting | SSL/TLS or implicit TLS | STARTTLS |
| Wrong mode | Client waits for a cleartext 220 and hangs | Client opens TLS immediately and fails the handshake |
| Role | Authenticated submission | Authenticated submission |
Port 25 is MX-to-MX relay, not this choice. Definitions of all three ports stay on SMTP ports 25, 465, and 587 explained. Handshake mechanics stay on STARTTLS vs implicit TLS.
Is port 465 deprecated?
No. Older advice called 465 deprecated after the original SMTPS assignment was withdrawn. RFC 8314 section 7.3 re-registered 465 as submissions for implicit TLS. A 2026 guide that still says 465 is dead is repeating the pre-2018 assignment, not the current registry.
What the mismatch looks like
STARTTLS on port 465
The client waits for a cleartext 220 banner. The server is already expecting TLS, so the banner never arrives. The symptom is a timeout, not an authentication error. Fix the encryption mode to implicit TLS, or move to 587 only if that host documents STARTTLS.
Implicit TLS on port 587
The client sends a TLS ClientHello. The server answers with a cleartext SMTP banner. The handshake fails immediately. Switch the client to STARTTLS, or move to 465 if the host documents implicit TLS.
These failures are not credential problems. Do not rotate the password until the port and the TLS mode agree.
What Arawa Mail documents
The connect-device guide, re-checked 9 October 2026, sets mailbox clients to SMTP port 465 with SSL/TLS, username the full email address, and the mailbox password. IMAP is port 993 with SSL/TLS. The guide does not list port 587 or STARTTLS for customer mailboxes. Do not invent a 587 endpoint.
Local sandbox defaults are different and unencrypted: SMTP 1025 and IMAP 1143. Those ports are for a local install, not production.
Application mail does not need either submission port. HTTP sending is a POST to the email API with an API key, after the domain is sending-active. See the getting started guide and SMTP vs email API.
Provider exceptions, not a new rule
Amazon WorkMail's IMAP setup page, re-checked 9 October 2026, sets outgoing SMTP to port 465 and states that STARTTLS is not currently supported. That is a host constraint. It does not make 587 invalid elsewhere. WorkMail itself is in an end-of-support window; the mailbox comparison is on ArawaMail vs Amazon WorkMail.
Other hosts often accept both modes. Confirm the page for the host you are configuring before you copy a sample. Port 2525 is an unofficial fallback some relays publish. Arawa docs do not mention it, so do not use it for an Arawa mailbox.
How we analyzed this
The decision follows RFC 6409 for submission and RFC 8314 for the implicit-TLS preference and the 465 re-registration. Provider behaviour was checked only where a current doc states a single mode: Arawa connect-device (465 SSL/TLS) and the WorkMail IMAP setup page (465, STARTTLS unsupported). We did not open a live SMTP session or send a message. OS-level connectivity tests are a separate topic.
FAQ
Should I use 465 or 587?
Use the mode your provider documents. If they document both, either is valid as long as the handshake matches the port.
Is 465 deprecated?
No. RFC 8314 registers 465 as submissions for implicit TLS.
Why does my client time out on 465?
It is usually waiting for a cleartext banner. Set implicit TLS, not STARTTLS.
Which port does Arawa Mail document?
Mailbox clients use SMTP 465 with SSL/TLS. The docs do not list 587.
Does the port change deliverability?
No. Deliverability follows authentication, complaints, and content. The port only decides whether the session can start.