--- title: "Email Server Ports Explained: Purpose, Protocols, and Security Best Practices" description: "Learn the purpose of common email server ports, including SMTP 25, 465, 587, IMAP 143 and 993, POP3 110 and 995, and essential email security practices." url: "https://www.gowrishankar.me/blog/email-server-ports-and-their-purposes" author: "Gowri Shankar Balasubramaniam" published: 2026-10-08T22:47:49.653Z category: "Email Server" tags: ["Email Server","Firewall Security","IMAP","Linux Server Administration","Mail Server Configuration","Network Ports","POP3","SMTP","Stalwart Mail Server","TLS","email security","zimbra"] --- # Email Server Ports Explained: Purpose, Protocols, and Security Best Practices > Learn the purpose of common email server ports, including SMTP 25, 465, 587, IMAP 143 and 993, POP3 110 and 995, and essential email security practices. Email Server Ports Explained: What Each Port Does and Why It Matters If you have ever configured an email server, you probably know that opening the correct ports is one of the first steps. But do you know why email servers use different ports, or what happens when one of them is blocked? Whether you are running Stalwart Mail Server, Zimbra, Postfix, or another mail platform, understanding these ports will help you troubleshoot email delivery problems and secure your infrastructure. In this article, I will explain the most commonly used email server ports, what each one does, and which ports you should allow through your firewall. ## Why Do Email Servers Need Different Ports? An email system does more than send and receive messages. It also needs to authenticate users, synchronize mailboxes, resolve domain names, and provide access through webmail or email clients. Each service uses a specific network port so that the client or server knows how to communicate with it. For example, when you send an email from Outlook, your email client typically connects to an SMTP submission service. When you open your inbox, it may connect to an IMAP service to retrieve your messages. Understanding this difference makes it much easier to configure firewalls and identify the source of email connectivity problems. ## Email Server Ports and Their Purposes Here is a quick overview of the ports you are most likely to encounter when managing an email server. | Port | Service | Purpose | | --- | --- | --- | | 25 | SMTP | Transfers emails between mail servers | | 465 | SMTP over TLS | Secure email submission | | 587 | SMTP Submission | Sends emails from authenticated clients | | 143 | IMAP | Accesses and synchronizes email | | 993 | IMAPS | Secure IMAP access | | 110 | POP3 | Downloads email messages | | 995 | POP3S | Secure POP3 access | | 4190 | ManageSieve | Manages server-side email filtering rules | | 443 | HTTPS | Provides webmail and supported email APIs | | 53 | DNS | Resolves mail server records and domain information | | 22 | SSH | Provides remote administration of Linux servers | Let's look at what these ports actually do. ## 1. Port 25 – SMTP Port 25 is one of the most important ports in email infrastructure. SMTP, or Simple Mail Transfer Protocol, uses this port primarily to transfer messages between mail servers. Imagine that someone sends an email from a Gmail account to an address hosted on your company mail server. The sending infrastructure looks up the recipient domain's MX record and connects to the destination mail server, typically using SMTP on port 25. If port 25 is blocked on your incoming mail server, external mail servers may be unable to deliver messages to you. If outbound SMTP traffic is blocked by your hosting provider, your server may also be unable to deliver messages directly to other mail servers. > **Security advisory:** Support STARTTLS, configure spam and connection controls, and make sure your server cannot be abused as an open relay. TLS availability alone does not guarantee that every connection is encrypted, so consider your organization's transport security requirements. ## 2. Port 465 – Secure SMTP Submission Port 465 is used for SMTP submission over implicit TLS. The connection is encrypted from the beginning. Email clients can use this port to send outgoing messages through an authenticated mail server. For example, if you configure an email account in a desktop client and select port 465 with SSL/TLS security, the client establishes an encrypted connection before exchanging SMTP commands. This is a good option when supported by your mail server and email client. ## 3. Port 587 – SMTP Submission Port 587 is another common port for sending emails from email clients and applications. The main difference between ports 465 and 587 is how TLS is established: - Port 465 starts with an encrypted TLS connection. - Port 587 typically establishes an SMTP connection and upgrades it using STARTTLS. Port 587 is widely used by applications that send notifications, invoices, password-reset emails, and other transactional messages. For production environments, require encryption before accepting authentication credentials, and apply appropriate sending limits to prevent compromised accounts from being abused. ## 4. Port 143 – IMAP IMAP stands for Internet Message Access Protocol. It allows users to access and synchronize emails stored on the mail server. Suppose you read an email on your laptop and then open the same mailbox on your phone. With IMAP, the read status and mailbox changes can synchronize across both devices. Port 143 is the standard IMAP port. It can support STARTTLS, but plaintext access should not be permitted for credentials or mailbox data. For new deployments, I generally recommend using port 993 with implicit TLS instead. ## 5. Port 993 – Secure IMAP Port 993 provides IMAP over an encrypted TLS connection. It is commonly used by desktop clients, smartphones, and other applications that need secure access to a mailbox. If your organization allows employees to access company email from outside the corporate network, port 993 is typically one of the ports you will need to consider exposing. Of course, exposing the port is only one part of the configuration. You should also use valid certificates, enforce secure authentication, monitor failed login attempts, and apply rate limits. ## 6. Port 110 – POP3 POP3 stands for Post Office Protocol version 3. It is used to retrieve messages from a mail server, often by downloading them to an email client. Unlike IMAP, POP3 is not primarily designed to synchronize mailbox state and folders across multiple devices. Whether messages remain on the server depends on the client's configuration and the server's behavior. Port 110 can support STARTTLS, but unencrypted access should be disabled wherever possible. If you are setting up a new email environment, consider whether POP3 is actually necessary. Many modern deployments can meet their users' requirements with IMAP alone. ## 7. Port 995 – Secure POP3 Port 995 provides POP3 over implicit TLS. It serves the same basic purpose as port 110, but the connection is encrypted from the beginning. Use it only if your users or applications require POP3. Otherwise, keeping this service disabled reduces the number of externally accessible services you need to maintain. ## 8. Port 4190 – ManageSieve ManageSieve is used to manage server-side email filtering rules. For example, a user might want emails from a particular sender to be moved automatically into a specific folder. With a compatible mail server and client, Sieve rules can perform this task on the server, even when the user's email client is offline. Port 4190 is not required by every email deployment. Enable it only when your mail server supports ManageSieve and you need this functionality. As with other account-facing services, protect it with TLS and authentication. ## 9. Port 443 – HTTPS and Webmail Port 443 is the standard HTTPS port. In an email environment, it is commonly used to access webmail through a browser. Depending on the product and configuration, it may also provide access to administration interfaces, APIs, or JMAP endpoints. JMAP is a modern protocol for accessing and synchronizing email and related data. Stalwart supports JMAP, making HTTPS an important part of a deployment that uses this protocol. Do not assume that every service is available simply because port 443 is open. Check which applications and endpoints your server actually exposes. For security, use valid TLS certificates and avoid exposing administrative interfaces directly to the public internet unless there is a clear requirement and appropriate access protection. ## 10. Port 53 – DNS DNS is essential for email delivery, even though it does not transfer email messages itself. When another mail server needs to deliver an email to your domain, it looks up the domain's MX record to identify the destination mail server. Other DNS records also matter: - **A and AAAA records** identify IPv4 and IPv6 addresses. - **MX records** identify mail delivery servers. - **PTR records** provide reverse DNS information. - **SPF records** specify authorized sending hosts. - **DKIM records** publish public keys used to verify email signatures. - **DMARC records** define policies and reporting for email authentication. DNS normally uses UDP port 53, with TCP port 53 also required for certain queries and responses. If you operate your own DNS infrastructure, make sure you do not accidentally expose an unrestricted recursive resolver to the internet. ## 11. Port 22 – SSH Administration SSH is not an email protocol, but it is essential for administering many Linux-based mail servers. Administrators use SSH to update packages, change configuration files, inspect mail logs, manage certificates, and troubleshoot connectivity issues. The biggest mistake is exposing SSH to everyone without appropriate restrictions. Where possible, allow SSH only from a management network or VPN. Use SSH keys, restrict privileged access, disable direct root login where appropriate, and monitor authentication activity. ## Which Ports Should You Open on Your Firewall? This is where the port list becomes useful in practice. For a typical mail server that receives email, supports authenticated client submission, provides IMAP access, and offers webmail, the initial firewall policy might look like this: | Port | Direction / Access | Requirement | | --- | --- | --- | | **25** | **Internet to mail server; outbound delivery as required** | **Required for direct SMTP mail exchange** | | **465 or 587** | **Trusted clients or permitted internet clients to mail server** | **Required if offered for email submission** | | **993** | **Authorized email clients to mail server** | **Required for IMAP over TLS** | | **443** | **Clients to webmail or supported HTTPS services** | **Required if those services are provided** | | 995 | Clients to mail server | Optional; only if POP3S is needed | | 4190 | Authorized clients to mail server | Optional; only if ManageSieve is needed | | 22 | Management network or VPN to server | Administrative access only | Ports 110 and 143 should be enabled only when needed, with appropriate TLS enforcement. If your server provides no public DNS service, you do not need to open port 53 to the internet on that server. Also remember that outbound firewall rules matter. A server can accept incoming connections and still fail to send email if outbound traffic is blocked. ## Common Email Port Problems When troubleshooting email issues, start by identifying which function is failing. **Incoming emails are not arriving:** Check the MX records, port 25 reachability, mail server listener, and firewall rules. **Users cannot send emails:** Verify the SMTP submission configuration, authentication, TLS settings, and ports 465 or 587. **Email clients cannot synchronize inboxes:** Check the IMAP configuration and port 993 connectivity. **Emails are being rejected or classified as spam:** Review SPF, DKIM, DMARC, reverse DNS, and sending IP reputation. Opening the correct ports alone will not resolve these issues. **Applications cannot send notifications:** Check whether the hosting provider restricts outbound SMTP, whether the application uses the correct submission port, and whether authentication and certificates are configured correctly. For Linux administrators, tools such as `ss -lntp`, `openssl s_client`, and `nc` can help verify listening services and connectivity. Use them from the appropriate client or server, keeping in mind that a successful TCP connection does not prove that authentication, TLS, or email delivery is working correctly. ## Summary Email server ports may look like a small part of the overall infrastructure, but they directly affect email delivery, user access, and server security. My recommendation is to keep the configuration simple: use port 25 for SMTP server-to-server delivery, port 465 or 587 for authenticated submission, port 993 for secure IMAP, and port 443 for webmail or supported HTTPS services. Everything else should be enabled only when there is a genuine business or technical requirement. A well-configured mail server is not one that exposes every available port. It is one that exposes the right services, protects authentication and data in transit, and allows administrators to monitor and troubleshoot the environment effectively. --- Source: https://www.gowrishankar.me/blog/email-server-ports-and-their-purposes