Common attacks and weaknesses
- Credential brute force to send spam from compromised accounts.
Port 587: SMTP submission
Authenticated email submission from mail clients, with STARTTLS.
587
How SMTP submission works
EmailMail servers hand messages to each other over port 587, one hop at a time, until the recipient's server. Encryption is optional: it only happens if both sides negotiate TLS (STARTTLS).
- Transport
- TCP · UDP
- Exposure risk
- 3/10 moderate if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
Is port 587 dangerous?
How to secure it
- Require STARTTLS before authentication.
- Rate-limit and alert on unusual sending volumes.
IANA registry entries for port 587
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| submission | 587 | TCP, UDP | Message Submission | RFC 6409 | 2011-11-17 |
// source: IANA service name and port number registry
Which program uses port 587, and is it reachable?
Linux
sudo ss -ltnup 'sport = :587' # process listening on 587
sudo lsof -nP -i :587macOS
sudo lsof -nP -i :587
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 587 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 587 netstat -ano | findstr :587
From another machine
nmap -p 587 -sV <host> sudo nmap -sU -p 587 <host> nc -zv <host> 587
Block it in the firewall
sudo ufw deny 587/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 587" -Direction Inbound -LocalPort 587 -Protocol TCP -Action Block # Windows
What is port 587 used for?
Authenticated email submission from mail clients, with STARTTLS.
Is port 587 TCP or UDP?
Port 587 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 587?
It is rated 3/10 (moderate) when exposed to the Internet. Credential brute force to send spam from compromised accounts. Require STARTTLS before authentication.
How do I check if port 587 is open?
On Linux run "ss -ltnup 'sport = :587'", on macOS "lsof -nP -i :587", and on Windows "netstat -ano | findstr :587" to see the local process. From another machine, "nmap -p 587 <host>" shows whether it is reachable.