SMTP errors on port 587, the submission checklist

Port 587 is the designated submission port (RFC 6409): the port where mail clients hand outgoing mail to their provider, with authentication required and STARTTLS expected. It has no single error code of its own; instead, submission failures arrive as connection errors or as codes like 530, 504, and 535, each pointing at one layer of the setup. The layers, from the wire up, are: the port must be reachable, encryption must start, authentication must be offered, and the credentials must be right. Testing in that order finds the fault without guessing.

The fix, in order

  1. Confirm reachability first. Errors like connection timed out or connection refused mean nothing reached a submission service. Verify the server name (it is often different from the incoming server, for example smtp.provider.com versus mail.provider.com), confirm the port is 587, and check that a firewall, hotel or office network, or security suite is not blocking outbound 587. A phone on mobile data is a quick alternate-network test.
  2. Set encryption to STARTTLS, not SSL/TLS. Port 587 starts plain and upgrades with STARTTLS. Choosing SSL/TLS (implicit TLS) on 587 produces instant failures or the server's "530 5.7.0 Must issue a STARTTLS command first". Implicit TLS belongs to port 465. This port-and-encryption pairing mismatch is the most common 587 configuration error.
  3. Turn authentication on. Submission servers require it. Enable outgoing server authentication in the client, using the full email address as the username. Skipping this yields 530 authentication required even with everything else perfect.
  4. Match the authentication mechanism. If the error is 504, the client offered a mechanism the server does not list. Set it to the normal password method (PLAIN or LOGIN) as advertised in the server's EHLO response.
  5. Then, and only then, suspect the password. A 535 after correct reachability, STARTTLS, and mechanism means the credentials themselves: re-enter the current password, and use an app password if the account has two-step verification enabled.
  6. Test the layers directly when a client hides the detail. On Windows, Test-NetConnection smtp.example.com -Port 587 confirms reachability. Deeper tests with an EHLO over a TLS session show the server's advertised STARTTLS and AUTH capabilities in plain text, ending all speculation about what the server offers.

If it still happens

Providers are steadily closing the alternatives: port 25 submission without authentication is refused almost everywhere now, which is why old configurations that worked for years fail suddenly. A client set to port 587, STARTTLS, authentication on, with the full address as username and an app password where two-step verification applies, matches what every major provider now expects.

Common questions

What is the difference between ports 587 and 465? Both are submission ports with different encryption styles: 587 upgrades a plain connection with STARTTLS, while 465 uses implicit TLS from the first byte. Either works when the client's encryption setting matches the port; mixing them is the classic failure.

Why does my provider tell me not to use port 25? Port 25 is the server-to-server relay port, and providers block or refuse unauthenticated client submission on it to fight spam. Port 587 exists precisely to give clients an authenticated, encrypted path that 25 was never designed to be.

Related errors

SMTP error 530 · SMTP error 535 · SMTP error 504