Email ports and encryption: SSL/TLS vs STARTTLS

Which email ports to use and why: 993, 995, 465 and 587, what SSL/TLS and STARTTLS mean, and how mismatches cause connection errors.

ExplainerIntermediate2 min readUpdated

Email apps ask for a port and a security type. Getting the pair right is the difference between connecting instantly and a mysterious timeout.

The ports for Traxio mail

ServicePortSecurity
IMAP993SSL/TLS
POP3995SSL/TLS
SMTP465SSL/TLS
SMTP587STARTTLS

SSL/TLS vs STARTTLS

  • SSL/TLS (sometimes “implicit TLS”): the connection is encrypted from the first byte. Used on 993, 995 and 465.
  • STARTTLS: the connection starts plain, then both sides agree to switch to encryption before anything sensitive is sent. Used on 587.

Both end up encrypted. “SSL” is the older name; modern connections use TLS either way.

Mismatches

SettingResult
Port 465 with STARTTLSHangs, then times out
Port 587 with SSL/TLS“Wrong version number” or handshake error
Port 993 with no encryptionConnection refused or garbled

Unencrypted ports

Ports 143 (IMAP), 110 (POP3) and 25/26 (SMTP) can work without encryption, which sends your password in readable form. Don’t use them.

Networks that block ports

Some hotel, school and workplace networks block mail ports. If email works on mobile data but not a particular Wi-Fi network, that network is the cause.

Popular

Tip: press / to search from any pageSee all results