---
title: "SMTP Port 2525 for Developers: 4 Ports, One Fallback for Agent Mail"
description: "Learn when SMTP port 2525 is a useful fallback, how to configure apps for authenticated TLS, and how Sendmux handles agent mail without SMTP port management."
canonical: "https://myagent.mx/blog/smtp-port-2525"
publishedAt: "2026-10-11T06:09:41.436Z"
updatedAt: "2026-10-13T11:18:55.517Z"
category: "deliverability"
topic: "SMTP server settings"
author: "Roshan Jonnalagadda"
authorProfile: "https://myagent.mx/blog/author/roshan-jonnalagadda"
keywords:
  - "SMTP server settings"
  - "How to configure SMTP"
  - "SMTP security protocols"
  - "Using port 2525 for email"
  - "Email delivery options"
  - "Alternative SMTP ports"
  - "What is SMTP port 2525"
  - "SMTP port troubleshooting"
  - "smtp port 2525"
---

# SMTP Port 2525 for Developers: 4 Ports, One Fallback for Agent Mail

Learn when SMTP port 2525 is a useful fallback, how to configure apps for authenticated TLS, and how Sendmux handles agent mail without SMTP port management.

![Developer configuring SMTP settings on a laptop](/images/blog/smtp-port-2525/image-1.svg)

Ports 587 and 465 are blocked, and your app or agent cannot send mail. Port 2525 may provide a working SMTP connection. Apps use SMTP to submit email to a mail server, and [RFC 6409](https://www.rfc-editor.org/info/rfc6409/) defines 587 as the submission standard. Try that first. Use 2525 only if your provider supports it, with authentication and TLS encryption required on whichever port you choose.

***

> **TL;DR:**
>
> - Port 2525 has no formal registration; test connectivity before switching, and use it only if 587 and 465 are blocked and your provider supports it.
> - Configure STARTTLS as mandatory, not optional, because a failed upgrade must stop transmission; also verify that the server hostname matches its certificate.
> - Port 25 handles server to server relay and is commonly blocked for outbound client traffic; port 465 uses implicit TLS from the first byte.
> - Port choice does not determine deliverability: publish SPF, DKIM, and DMARC records, authenticate every submission, and check provider rate limits before production use.

***

## Table of Contents

- [Ports 25, 587, 465 and 2525: what each one is for](#ports-25-587-465-and-2525-what-each-one-is-for)
- [What port 2525 actually is and why providers support it](#what-port-2525-actually-is-and-why-providers-support-it)
- [Securing a connection on port 2525](#securing-a-connection-on-port-2525)
- [When switching to port 2525 makes sense](#when-switching-to-port-2525-makes-sense)
- [Configuring clients and servers for port 2525](#configuring-clients-and-servers-for-port-2525)
- [Troubleshooting connection timeouts and blocked ports](#troubleshooting-connection-timeouts-and-blocked-ports)
- [Keeping deliverability solid on a non-standard port](#keeping-deliverability-solid-on-a-non-standard-port)
- [Why submission reliability matters more as agents send their own mail](#why-submission-reliability-matters-more-as-agents-send-their-own-mail)
- [Mailbox options for agents with Sendmux](#mailbox-options-for-agents-with-sendmux)
- [FAQ](#faq)
- [Sources](#sources)

## Ports 25, 587, 465 and 2525: what each one is for

Separate app submission from messages passed between mail servers when choosing among these four SMTP ports. For the wider domain and mailbox setup, see this [business email setup](https://redrockwebscapes.com/blog/business-email-setup) guide.

- **Port 25** handles server-to-server relay, where one mail server hands a message to another. Many networks and cloud hosts restrict outbound traffic here to reduce spam. Choose a submission port for your app or agent.
- **Port 587** is the RFC 6409 submission port for apps and other mail clients. Try it first. Providers commonly pair it with authentication and STARTTLS, the command that upgrades a connection to encryption.
- **Port 465** starts encryption before any SMTP command, using implicit TLS, also called SMTPS. Plenty of providers still support it. It works well when STARTTLS negotiation causes problems.
- **Port 2525** provides an alternative SMTP submission connection outside the standard mail submission ports. Providers supporting it commonly use STARTTLS, as on 587.

Read [SMTP submission versus relay](https://myagent.mx/blog/smtp-submission-vs-relay) to understand why apps should use submission. Its six questions help you choose a connection before setting up the client.

## What port 2525 actually is and why providers support it

Port 2525 has no IANA service name registry entry and no RFC behind it. It has no formal standing. Mail providers needed a workaround for blocked ports 587 and 25, and 2525 became the de facto choice through convention.

Informal, but common. Cloud and PaaS environments frequently restrict outbound traffic on 25 and sometimes 587 to curb spam and abuse. Google's tutorial for [sending email with Mailgun](https://cloud.google.com/compute/docs/tutorials/sending-mail/using-mailgun) addresses that directly, walking through opening outbound TCP port 2525 because default submission ports are off limits on many instances.

Reasons teams end up on 2525 tend to repeat:

- Hosting providers and corporate firewalls may block 25 and 587 to limit unwanted outbound mail.
- Managed application hosting platforms may restrict outbound SMTP under their abuse-prevention policies.
- Development or staging environments may need a submission connection permitted by their firewall rules.

Port 2525 can still be restricted. Your mail provider must support it and your network must allow it, just as with 587.

## Securing a connection on port 2525

Check the encryption method your provider requires on 2525. The number alone tells you little. STARTTLS upgrades an unencrypted connection to TLS before credentials or mail are sent, while implicit TLS starts encrypted, as on port 465. STARTTLS is common on both 2525 and 587.

![STARTTLS and implicit TLS compared by connection sequence](/images/blog/smtp-port-2525/image-2.svg)

A STARTTLS connection that never upgrades can expose credentials and message content in plaintext. This is sometimes called a STRIPTLS downgrade. [RFC 8314](https://datatracker.ietf.org/doc/html/rfc8314) discusses implicit versus explicit TLS for mail submission. Require TLS in your client or library so a failed upgrade aborts the connection instead of falling back silently to plaintext.

Verify the server's certificate too. It identifies the server your client reached, and the hostname in your settings must match. Use the provider's documented hostname. An IP address or another endpoint can fail certificate validation.

**Pro Tip:** *Require TLS in your SMTP library so a blocked upgrade fails visibly. A setting that merely tries TLS can send mail unencrypted.*

Our guide to resolving [587 versus 465](https://myagent.mx/blog/smtp-ports-587-vs-465) compares STARTTLS and implicit TLS in practice, including the checks we'd run on either port.

## When switching to port 2525 makes sense

If your usual submission connection is blocked and your provider offers 2525, check these conditions before changing the configuration.

1. **Both 587 and 465 are blocked by your network or host.** Test connectivity from the environment running your app before concluding that a port restriction caused the problem.
2. **You're running on a cloud instance or managed hosting platform that restricts outbound SMTP.** Check its current network rules alongside your mail provider's connection instructions.
3. **You're in a development or test environment where opening 587 is not practical yet.** Check that this environment allows 2525.
4. **Your mail provider explicitly documents 2525 support.** You need that support to switch, but it gives you no reason to switch by itself. Confirm hostname, encryption and authentication settings too.

Start with 587 if your provider and network allow it. RFC 6409 defines it for submission, giving setup and troubleshooting a standard starting point.

## Configuring clients and servers for port 2525

When STARTTLS is used on both 2525 and 587, changing the port number may be the only client setting you need to alter. Check that the hostname and credentials stay the same first.

For How to configure SMTP on port 2525, check four SMTP server settings: hostname, port 2525, required encryption method and authentication credentials. Use your provider's details. With STARTTLS, require the TLS upgrade and validate the server certificate. The Postfix and Nodemailer examples below show the connection shape, but their security settings need completing before production use.

For a Postfix relay host, the configuration looks like this:

- `relayhost = [smtp.yourprovider.com]:2525`
- `smtp_tls_security_level = encrypt`
- `smtp_sasl_auth_enable = yes`
- `smtp_sasl_security_options = noanonymous`

A Nodemailer setup in Node.js follows the same shape:

- `host: "smtp.yourprovider.com"`
- `port: 2525`
- `secure: false` lets Nodemailer connect before negotiating STARTTLS. It does not require the upgrade. Add `requireTLS: true` with certificate validation kept enabled.
- `auth: { user: "...", pass: "..." }`

Before going live, check that the outbound firewall allows port 2525 and the hostname matches your provider's instructions. Test the TLS handshake separately from the application. Postfix needs certificate verification configured as well as required encryption, since encryption alone does not establish certificate identity verification.

Cloud and PaaS environments commonly block outbound port 25 to curb spam. Provider documentation increasingly treats 2525 as a documented workaround because of that restriction.

## Troubleshooting connection timeouts and blocked ports

These three checks resolve most port 2525 problems before you need support.

1. **Test raw reachability first.** Run `telnet smtp.yourprovider.com 2525` or `nc -zv smtp.yourprovider.com 2525`. A timeout or refusal means the connection failed before authentication. Check hostname, server availability and network rules. The result alone cannot prove a firewall block.
2. **Confirm firewall and egress rules** on your host or cloud platform. Many providers block outbound SMTP ports by default at the instance or security-group level, separately from application configuration.
3. **Check the TLS handshake directly** with `openssl s_client -starttls smtp -connect smtp.yourprovider.com:2525`. It helps inspect the encryption exchange. Your app's certificate validation still needs checking separately. Review certificate and authentication errors separately in client logs.

**Pro Tip:** *Give your provider the exact timestamp, your client's outbound IP address and the command you ran. Support can then investigate that connection attempt.*

## Keeping deliverability solid on a non-standard port

A working connection starts the delivery process. Switching between 587, 465 and 2525 still leaves sender authentication, domain records and monitoring to handle.

- Maintain published **SPF, DKIM and DMARC** records for your sending domain. Receiving servers use them to check authorised senders, message signatures and how to handle authentication failures.
- Use **authenticated submission** with your provider's required credentials. Avoid open relays, which accept mail without proper access controls, and port 25 for ordinary app submission.
- **Monitor bounce and complaint rates** against your provider's thresholds. If you suspect someone else has credential access, rotate them.
- **Confirm your provider's 2525 support and any rate limits** before production use. Reachability alone tells you nothing about how much mail your account can submit.

Read [Cloudflare's own guidance](https://www.cloudflare.com/learning/email-security/smtp-port-25-587/) for a wider explanation of submission ports. Compare Email delivery options by checking connection settings, sender authentication and recipient filtering separately.

## Why submission reliability matters more as agents send their own mail

Imagine an agent scheduling on someone's behalf whose port 587 connection is blocked. Its reply may never reach the customer. The unattended agent needs to report that sending failed so someone can investigate before the customer follows up.

Test the agent's sending connection where it will run. Decide who will act on failed attempts and how they'll be recorded. A supported fallback port can handle a port restriction. Check other failures separately.

## Mailbox options for agents with Sendmux

For agents that need their own stored mail, [Sendmux](https://sendmux.ai) supports mailbox provisioning.

- Agents can get a mailbox on the shared @myagent.mx domain, or on a verified custom domain that allows mailboxes. The shared-domain provisioning path requires no customer domain verification.
- Outbound provider selection filters out disabled providers and those at quota, then selects from the available providers by configured weights.
- SMTP submission is configured on ports 587 and 2525 with STARTTLS advertised.

Choose this route for provisioning several agents' mailboxes at once instead of configuring one SMTP client, or when provider failover matters more to you than managing firewall rules by hand. The Sendmux free plan includes a limited number of mailboxes. Set up an [agent mailbox](https://myagent.mx/) to see the sending options directly.

## FAQ

### What is port 2525 used for?

Port 2525 is used as an alternative SMTP submission port when the standard ports, 587 and 465, are blocked by a network, firewall or cloud host. It typically works the same way as port 587, using STARTTLS to upgrade the connection to an encrypted one after authentication.

### Is port 25 the default port for SMTP?

Port 25 is the original SMTP port, but it's intended for server-to-server mail relay rather than client submission. RFC 6409 defines port 587 as the dedicated submission port for clients and applications, and most networks block port 25 for outbound client traffic to limit spam.

### Should I use port 25 or 587 for SMTP?

Use port 587 for client and application submission. It's the port RFC 6409 specifies for this purpose, it supports STARTTLS and authentication by default, and port 25 is routinely blocked for outbound client traffic by ISPs and cloud providers.

### Is SMTP port 25 TCP or UDP?

SMTP, including port 25, runs over TCP, not UDP. All the common SMTP submission and relay ports, 25, 465, 587 and 2525, use TCP connections, since mail transfer needs the reliable, ordered delivery that TCP provides.

## Sources

- [RFC 6409 — Message Submission](https://www.rfc-editor.org/info/rfc6409/)
- [Google Cloud — Sending email with Mailgun](https://cloud.google.com/compute/docs/tutorials/sending-mail/using-mailgun)
- [Cloudflare Learning — SMTP ports 25, 465, 587](https://www.cloudflare.com/learning/email-security/smtp-port-25-587/)

## Recommended

- [SMTP Port 587 vs 2525: Which Should You Use?](https://sendmux.ai/blog/email-deliverability/587-vs-2525)
- [AgentMail Alternatives for Developers: Inbox & API Picks](https://myagent.mx/blog/agentmail-alternatives)
- [Best SMTP Providers for Developers in 2026](https://myagent.mx/blog/best-smtp-providers)
- [Developers: 6 RFC Based Questions to Choose SMTP Submission or Relay](https://myagent.mx/blog/smtp-submission-vs-relay)