SSL/TLS Port 465 vs STARTTLS Port 587: Which SMTP Setting is Actually Safer?

There is a question that trips up nearly every developer, system administrator, and business owner who sets up their own email server. When your mail client shows you a dropdown with two options — SSL/TLS (port 465) or STARTTLS (ports 587 and 2525) — which one do you actually pick?

Most tutorials confidently recommend STARTTLS on port 587. Dozens of legacy hosting guides, Mailcow documentation screenshots, and Stack Overflow answers point you toward 587. If you have been doing this for years, that is probably what you are using right now.

Here is what those guides quietly skip over: SSL/TLS on port 465 is definitively the safer, faster, and more modern choice in 2025. The reason most documentation still defaults to 587 is inertia — not technical superiority.

This article explains the fundamental difference between the two protocols, why SSL/TLS 465 wins on every technical dimension that matters, and when STARTTLS is still the right choice (there is one real scenario).

1. The Core Difference: Encryption Timing

The most important thing to understand about these two protocols is not the port number. It is when the encryption begins.

SSL/TLS (Port 465) — Encryption First:

The moment your email client makes a connection to the server on port 465, an encrypted TLS tunnel is established. Every single byte — including your username, your password, and the email headers — is encrypted from the very first millisecond of the connection. The server never sees your credentials in plaintext. There is no window where the connection is vulnerable.

STARTTLS (Port 587 / 2525) — Upgrade Model:

Your email client connects to the server on port 587. The initial connection is completely unencrypted. Your client first sends a greeting, the server responds with its capabilities in plaintext, and then — only after this initial plaintext handshake — your client says "hey, let's upgrade to TLS now" via a STARTTLS command. The server agrees, and the connection becomes encrypted.

That gap between the initial connection and the TLS upgrade is the core architectural weakness of STARTTLS.

2. The STARTTLS Downgrade Attack (Why It Matters)

The vulnerability that keeps serious security engineers up at night is called a STARTTLS downgrade attack, also known as a STRIPTLS attack.

Here is how it works: An attacker who can intercept traffic between your email client and your server (a Man-in-the-Middle attack, which is alarmingly common on shared networks, corporate firewalls, and compromised routers) can intercept the unencrypted initial connection and strip the STARTTLS capability announcement out of the server's response.

Your client never sees the STARTTLS option. Without knowing it is available, your client quietly falls back to sending your email in plain, unencrypted text. Your username, your password, and every word of your email can be read by the attacker in perfect clarity.

This cannot happen with SSL/TLS on port 465. Because the TLS tunnel is established before any data is exchanged, there is nothing for an attacker to intercept or downgrade. The connection is either fully encrypted from the start, or it fails completely. There is no fallback to plaintext.

3. Why Does Port 587 Still Exist?

If SSL/TLS 465 is more secure, why is port 587 still the default recommendation in so many places?

The answer is history. Port 465 was officially assigned for SMTPS (SMTP over SSL) in 1997, but was controversially unassigned by the IANA just one year later in 1998 — before it was widely adopted. Port 587 was then designated as the official "mail submission" port with STARTTLS support.

For the next 20 years, the industry built around port 587. Corporate firewalls were configured to allow 587. Client software was written to default to 587. Documentation was written around 587.

Then in 2018, the IANA quietly but officially reassigned port 465 for SMTPS with implicit TLS. The security community broadly agrees today that 465 with SSL/TLS is the correct modern choice. The problem is that 20 years of inertia means most tutorials have not caught up yet.

4. Head-to-Head Comparison: SSL/TLS vs STARTTLS

5. The One Scenario Where STARTTLS 587 is Still Correct

There is exactly one legitimate reason to use STARTTLS on port 587 in 2025: you are connecting from behind an old corporate or ISP firewall that actively blocks port 465.

Some enterprise networks, particularly in older industries like finance, government, and healthcare, have strict firewall rules that only allow outbound traffic on specific ports. If your IT department's firewall blocks 465 and you have no ability to change it, STARTTLS on 587 is your only option.

Port 2525 is a fallback that exists for exactly this reason — ISPs historically blocked both 25 and 465 on residential connections, so 2525 was added as an alternative submission port for STARTTLS. If you are on a consumer internet connection (not a business connection), port 2525 may work when 465 is blocked.

Outside of these specific corporate or ISP firewall scenarios, there is no technical justification for choosing STARTTLS over SSL/TLS on a modern mail server.

6. What This Means for Your Mailcow Setup

If you are running a private Mailcow server (like mail.twamehi.com or any other self-hosted mail infrastructure), your configuration should be:

• SMTP Submission Port: 465
• Security Protocol: SSL/TLS (also called Implicit TLS)
• Authentication: Your full email address and mailbox password

Mailcow fully supports implicit TLS on port 465 out of the box. There is no configuration needed on the server side — it is enabled by default.

When connecting external apps (newsletter tools, CRM systems, autoresponders) to your Mailcow server via SMTP, always specify 465 with SSL/TLS as the security method. If the connection app gives you an error with 465, try toggling between "SSL/TLS" and "Implicit TLS" — they are the same thing, just named differently in different interfaces.

7. Checking Your Existing Configuration

If you want to verify that your current mail setup is using the strongest possible encryption, here is a quick PowerShell test you can run on any Windows machine:

Test-NetConnection -ComputerName mail.yourdomain.com -Port 465

If the result shows TcpTestSucceeded: True, your server is listening on 465 and ready to accept SSL/TLS connections. If it shows False, your server may only be configured for STARTTLS on 587, and you should check your Mailcow or server settings.

8. The Bottom Line for Developers and Business Owners

The SSL/TLS vs STARTTLS debate has a clear winner in 2025. SSL/TLS on port 465 is faster, more secure by design, immune to downgrade attacks, and the officially recognized modern standard.

The only reason to use STARTTLS on 587 or 2525 is if your specific network environment actively prevents port 465 connections. That is a network constraint, not a security preference.

For your private mail server, your newsletter tool, your CRM SMTP connection, and any other outbound email configuration: choose SSL/TLS on 465 every single time.