SSL/TLS vs STARTTLS: which SMTP port and setting your app should use

Every mail library and framework asks the same questions when you configure outgoing mail: host, port, and an encryption setting that is usually some mix of "SSL", "TLS", "STARTTLS" and "None". The names are confusing because they are historical. This guide explains what each one actually does and which to pick when your application sends mail from a Cloud Server.

Short answer: use port 465 with implicit TLS (often labeled "SSL" or "SSL/TLS") if your mail provider supports it, or port 587 with STARTTLS if it does not. Never use no encryption.

The terms

SSL (Secure Sockets Layer) is the original protocol. Every version of it is now considered insecure; SSL 3.0 fell to the POODLE attack in 2014. The name survives in configuration menus out of habit, where "SSL" almost always means TLS underneath.

TLS (Transport Layer Security) is SSL's successor and what actually runs today. TLS 1.0 and 1.1 are retired; TLS 1.2 and 1.3 are current.

STARTTLS is not a protocol but a command. The client connects in plain text on the normal port, then asks the server to upgrade the connection to TLS. SMTP, IMAP and POP3 all support it.

The practical difference

Both end up negotiating the same TLS, so the encryption is equally strong. What differs is when it starts.

That last row is the reason to prefer implicit TLS. With STARTTLS, a misconfigured client, or an attacker on the path who strips the STARTTLS offer, can leave the connection in plain text, sending your SMTP password unencrypted. With implicit TLS there is no unencrypted state to fall back to.

If you do use STARTTLS, make sure your library requires it rather than merely attempting it.

Which ports are for what

Your application should submit mail on 465 or 587 to an authenticated mail service (your mail provider or a transactional email service). Port 25 is for mail servers talking to each other, is commonly filtered on networks of all kinds, and is the wrong choice for an app.

Configuration examples

Laravel (.env)

MAIL_MAILER=smtpMAIL_HOST=smtp.example.comMAIL_PORT=465MAIL_SCHEME=smtps[email protected]MAIL_PASSWORD=your-smtp-password

For port 587, set MAIL_PORT=587 and MAIL_SCHEME=smtp; Symfony Mailer upgrades with STARTTLS automatically when the server offers it.

Node.js (Nodemailer)

const transporter = nodemailer.createTransport({  host: 'smtp.example.com',  port: 465,  secure: true, // implicit TLS  auth: { user: '[email protected]', pass: process.env.SMTP_PASSWORD },}); // Port 587 instead:// { port: 587, secure: false, requireTLS: true, ... }

Python (smtplib)

import smtplib, ssl with smtplib.SMTP_SSL("smtp.example.com", 465, context=ssl.create_default_context()) as s:    s.login("[email protected]", password)    s.send_message(msg)

Test from the server

Check that the port is reachable and the certificate is valid before blaming your code:

# Implicit TLS on 465openssl s_client -connect smtp.example.com:465 -servername smtp.example.com -brief # STARTTLS on 587openssl s_client -connect smtp.example.com:587 -starttls smtp -brief

A line showing the negotiated protocol (for example TLSv1.3) and a 220 greeting from the mail server means the connection works. If it hangs, test the port itself:

nc -vz smtp.example.com 465

Why "PLAIN" authentication is fine

Many libraries ask for an authentication method, and the usual choice is PLAIN or LOGIN. That sounds alarming but is not: encryption is established first, so the password travels inside the TLS channel. It is only unsafe with encryption set to "None", which you should never use.

Sending deliverable mail

Encryption gets your message to the mail service securely. Whether it reaches the inbox depends on your domain's DNS: publish SPF, DKIM and DMARC records as your mail provider instructs. If you run your own mail server on a Cloud Server rather than using a provider, the server also needs a matching reverse DNS (PTR) record; contact support to have it set for your IP.

Next steps

• Deploy an app server close to your users: Cloud Servers in six locations.
• Store attachments and generated files in Object Storage.
• Questions about your setup? Open a ticket or email [email protected], or browse the Help Center.