Blog

SMTP Port 465 vs 587: How Patriot Mail Keeps Outgoing Email Encrypted

Port 465 uses implicit TLS, port 587 uses STARTTLS. Here is the difference, why STARTTLS can be downgraded, and how Patriot Mail makes sure your outgoing mail is never sent in the clear.

Published

July 21, 2026

When you send an email, your app hands the message to your provider's outgoing (SMTP) server. That handoff can happen over an encrypted connection or, if something goes wrong, over a plain one. Patriot Mail makes sure it is always encrypted. Here is how, and why the port number matters.

The two submission ports:

  • Port 465 - implicit TLS. Encryption starts the instant the connection opens, before any email data is exchanged. There is never a plaintext moment.
  • Port 587 - STARTTLS. The connection opens in plain text, then the app asks the server to upgrade to an encrypted channel with a command called STARTTLS.
Both can be perfectly secure. The difference is what happens when someone is interfering with your connection.

Why STARTTLS can be weaker

Because a port 587 connection begins unencrypted, there is a brief window before the upgrade. An attacker positioned between you and your provider can quietly remove the server's offer to upgrade. A lenient email app then never sees that encryption was available and continues in plain text, exposing your login and message. This is called STARTTLS stripping, and it is a well known downgrade attack.

Port 465 has no such window. The connection is encrypted from the first byte, so there is nothing to strip. This is why the current standard for sending mail (RFC 8314) recommends implicit TLS on 465. As a bonus, 465 also skips a round trip, so it connects a touch faster.

What Patriot Mail does

Two things, together, guarantee your outgoing mail is never sent in the clear:

  • We prefer port 465 (implicit TLS) wherever the provider supports it. That covers Gmail, Yahoo, iCloud, GMX, and the Polish providers WP (wp.pl), o2.pl, Onet, Interia, and Gazeta.pl, plus Zoho and mail.com.
  • We require TLS on the remaining connections. A few providers, such as personal Outlook, only offer port 587. For those, Patriot Mail insists on the STARTTLS upgrade and refuses to send if the server will not encrypt. If a connection cannot be secured, the message does not go out - it never falls back to plain text.
In short: on 465 the connection is born encrypted, and on 587 we make encryption mandatory. Either way, your credentials and your email are protected in transit.

Do you need to change anything?

No. When you add an account, Patriot Mail fills in the correct server and port for your provider automatically, and applies the right encryption for that port. If you set up the same account in another email app by hand, this is the short version to use:

  • If the provider lists a port 465 option, choose it and set the security to SSL/TLS.
  • If it only lists 587, use it with STARTTLS - and make sure your app requires encryption rather than treating it as optional.
Both are safe when configured correctly. Patriot Mail simply makes the safe choice for you, and never lets a send happen without encryption.

If an account will not connect for sending, it is almost never the port - it is usually a provider setting, like IMAP access being turned off or an app password being required. Our per-provider setup guides walk through those steps.

Are you sure?