Office 365 SMTP ports define the gateway for authenticated and secure email delivery from apps and servers to Microsoft cloud mailboxes. Choosing the right port and encryption method is essential for reliable delivery, avoiding spam filters, and supporting modern authentication.
Modern workloads often combine legacy protocols with newer authentication standards to balance compatibility and security. Understanding these ports and settings helps reduce delivery issues and simplifies troubleshooting.
| Port | Encryption | Authentication Required | Common Use Case |
|---|---|---|---|
| 587 | STARTTLS (TLS) | Yes | Outbound submission from mail clients and servers |
| 465 | Implicit SSL/TLS | Yes | Legacy SSL-based submission scenarios |
| 25 | STARTTLS (recommended) | Yes (when supported) | Internal relay between mail servers; may be blocked by cloud services |
| 587 (alternate) | TLS | Yes | Client apps when 587 is already whitelisted in your policy |
| 465 (alternate) | SSL/TLS | Yes | Applications requiring immediate encrypted session |
Port 587 Submission for Reliable Delivery
Port 587 is the recommended SMTP submission port for Office 365 and most modern email services. It enforces message submission and requires authenticated users, which reduces abuse and improves deliverability. When you configure a mail client or application, using port 587 with STARTTLS ensures encryption after the connection is established.
STARTTLS upgrades the connection securely without requiring an implicit SSL layer, making it easier to manage certificates and compatibility. Most cloud connectors and modern mail transfer agents default to this port for outbound authentication-based delivery. Admins can enforce policies that restrict non-authenticated traffic on port 587 to further control email flow.
In practical deployments, port 587 is ideal for desktop clients, mobile devices, and third-party services that need to submit mail to Office 365. Because it is designed for message submission rather than server-to-server relay, it is less likely to be impacted by intermediate network restrictions.
Port 465 for SSL-Based Sessions
Port 465 handles SMTP with implicit SSL, wrapping encryption from the first byte of the connection. Some legacy applications and devices require this approach because they do not support the STARTTLS command. If your environment includes older hardware or niche software, port 465 can provide a straightforward secure path to Office 365.
Although Microsoft lists port 465 as deprecated in some documentation, it remains available and widely used in production. The practical difference from port 587 is the connection setup timing, not the strength of encryption. When choosing between 465 and 587, consider the capabilities of the sending application and any proxy or firewall behavior.
For modern Office 365 deployments, port 465 still enforces authentication and encrypted transmission, giving a reliable fallback for scenarios where STARTTLS cannot be negotiated cleanly. Ensure clients use valid TLS certificates and modern ciphers to avoid compatibility issues.
Port 25 and Server-to-Server Considerations
Port 25 is traditionally used for server-to-server SMTP relay. In Office 365, you can use port 25 between on-premises servers and the cloud, but it may be blocked by cloud providers or require explicit configuration. Many organizations prefer authenticated submission over port 587 to avoid relay restrictions and centralize control.
If you must use port 25, enable STARTTLS to protect credentials and message content, and verify that intermediate networks allow the port. Office 365 supports authenticated use of port 25 for connectors and partner solutions, but it typically requires proper domain verification and configuration in the admin center.
Understanding how port 25 interacts with anti-spam policies, connectors, and outbound rules helps avoid delivery delays. Monitoring connection logs and authentication results ensures that server-to-server flows remain healthy and compliant with organizational security expectations.
Common Configuration Mistakes and Best Practices
Misconfigured ports and encryption settings are a frequent source of email delivery failures. Some setups specify port 587 but leave encryption disabled, while others use the wrong credentials or outdated authentication mechanisms. Consistency across clients, connectors, and relay devices is essential for smooth operations.
Always use modern authentication methods like OAuth 2.0 or verified senders aligned with SPF, DKIM, and DMARC to improve deliverability. Test different scenarios, from external senders to internal relays, and validate TLS versions and cipher suites against current security guidance.
Document port and protocol choices as part of your email architecture, and periodically review them against platform updates. This approach reduces troubleshooting time and makes it easier to adapt to policy changes or new compliance requirements.
Key Takeaways for Office 365 SMTP Configuration
- Port 587 is the recommended submission port for authenticated email to Office 365.
- Use STARTTLS on port 587 to enforce encryption without legacy SSL dependencies.
- Port 465 offers implicit SSL as a fallback for applications that require it.
- Port 25 can work for server-to-server flows but often needs explicit configuration and may face restrictions.
- Authentication, encryption, and network policies must align to ensure reliable and secure delivery.
FAQ
Reader questions
Which port should I use for Office 365 from my on-premises server?
Use port 587 with STARTTLS and authenticated submission for reliable delivery from on-premises servers to Office 365. Port 25 is an alternative for server-to-server connectors when properly configured and allowed by your network and Microsoft policies.
Can I use port 465 with modern Office 365 connectors?
Yes, port 465 with implicit SSL can be used for Office 365, especially with legacy applications. However, port 587 is generally preferred because it uses explicit TLS and aligns better with modern submission practices.
Will my email still be encrypted if I use port 25 without STARTTLS?
No, port 25 without STARTTLS sends email in clear text, which is insecure and often blocked. Always enable STARTTLS on port 25 or switch to port 587 to enforce encryption and authentication.
Why do my automated scripts fail when using port 587 with Office 365?
Scripts may fail due to missing authentication, incorrect credentials, or lack of support for modern authentication methods like OAuth. Ensure the script uses valid credentials, supports TLS, and is configured for SMTP authentication.