Port 465 SMTPS · TCP

What runs on port 465

SMTP submission over implicit TLS (SMTPS). It was deprecated in favour of 587 with STARTTLS, then re-standardised in RFC 8314 because implicit TLS is simpler and cannot be stripped. Mail clients and applications submit outgoing mail here with authentication; servers do not use it between themselves.

Software that uses it: Postfix (smtps in master.cf) · Exim · Exchange · Gmail/Outlook SMTP servers for clients

Should port 465 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Offer both 465 and 587; some clients and libraries only do one of them well.
• openssl s_client -connect mail.example.com:465 should show a TLS handshake immediately, with no STARTTLS step.

Check port 465

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :465'
sudo lsof -i :465

# from another machine: is it reachable?
nc -zv host 465
nmap -p 465 host
curl -v telnet://host:465      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 465

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 465 proto tcp
sudo ufw deny 465/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 465 accept
nft add rule inet filter input tcp dport 465 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 465 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 465 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=465 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 465" with no source is just "open".

Related ports

• 587 SMTP submission — Mail from clients, STARTTLS
• 25 SMTP — Mail transfer between servers
• 993 IMAPS — IMAP over TLS

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions