SMTP

Q: Which SMTP port should I use?

When an application or mail client submits email, use port 587 with STARTTLS or port 465 with TLS, and log in. Port 25 is for delivery between mail servers and is often blocked for regular customers by internet and cloud providers to limit spam.

Simple Mail Transfer Protocol

Updated September 30, 20263 min read

In short

SMTP is the internet's standard protocol for sending email, used by apps to submit messages and by mail servers to relay them to the recipient's mail server.

What is SMTP?

SMTP, the Simple Mail Transfer Protocol, is the protocol that moves email across the internet. When you press send, your mail app, or your application's code, hands the message to an SMTP server, which then delivers it to the mail server responsible for the recipient's domain. SMTP only handles sending and relaying; it has no way to read a mailbox.

SMTP is a text-based conversation over TCP. The client greets the server with EHLO, names the sender with MAIL FROM, names each recipient with RCPT TO, sends the message after DATA, and ends with QUIT, and the server answers each step with a numeric code, such as 250 for success. To find where to deliver a message, the sending server looks up the MX (mail exchanger) records of the recipient's domain in DNS. Port 25 is used between mail servers, while apps and mail clients submit mail on port 587 with STARTTLS or port 465 with TLS from the start, after logging in.

SMTP works like the trucks that carry letters between post offices: it gets a letter from the sender's post office to the recipient's, but it doesn't put it in anyone's hands. Developers meet SMTP when their application sends password resets, receipts, and notifications, either through their own mail server or an email delivery service. Because the original protocol doesn't verify who sent a message, receiving servers also check DNS records called SPF, DKIM, and DMARC to judge whether an email is genuine, which is essential both for staying out of spam folders and for fighting phishing.

SMTP is often confused with IMAP and POP3. SMTP sends and relays mail, while IMAP and POP3 are what mail clients use to retrieve messages from a mailbox: IMAP keeps mail on the server and syncs it across devices, and POP3 usually downloads it to one device. A typical email app therefore uses SMTP for outgoing mail and IMAP for incoming mail.

Key takeaways

SMTP is the standard protocol for sending and relaying email.
Mail servers exchange messages on port 25; apps submit mail on port 587 or 465 with TLS.
Senders find the recipient's mail server through DNS MX records.
SPF, DKIM, and DMARC records help receiving servers verify senders and reduce spoofing.
SMTP sends mail, while IMAP and POP3 retrieve it.

Example

Sending an email over SMTP in Pythonpython

import os
import smtplib
from email.message import EmailMessage

msg = EmailMessage()
msg["From"] = "app@example.com"
msg["To"] = "user@example.org"
msg["Subject"] = "Reset your password"
msg.set_content("Use the link below to choose a new password.")

# Submit on port 587, upgrade the connection to TLS, then log in
with smtplib.SMTP("smtp.example.com", 587) as server:
    server.starttls()
    server.login("app@example.com", os.environ["SMTP_PASSWORD"])
    server.send_message(msg)

Readers ask

What is the difference between SMTP, IMAP, and POP3?

SMTP sends email from a client to a server and between servers. IMAP and POP3 retrieve email from a mailbox: IMAP keeps messages on the server and syncs them across devices, while POP3 usually downloads them to one device.

Which SMTP port should I use?

When an application or mail client submits email, use port 587 with STARTTLS or port 465 with TLS, and log in. Port 25 is for delivery between mail servers and is often blocked for regular customers by internet and cloud providers to limit spam.

Why do emails sent by my app end up in spam?

The most common causes are missing or incorrect SPF, DKIM, and DMARC records for your domain, sending from an IP address with a poor reputation, or content that looks like spam. Setting up those DNS records correctly is the first thing to check.