TCP Port 465 – SMTPS (Implicit-TLS Mail Submission)

Port 465 is the standard port for SMTPS, mail submission over an implicit TLS connection. It is one of three ports that mail clients commonly use to send outgoing email, alongside SMTP on port 25 (mostly server-to-server in modern deployments) and SMTP Submission with STARTTLS on port 587 (the IETF-preferred submission method). When a desktop email client like Outlook, Thunderbird, or Apple Mail submits a message to a mail provider’s outgoing server, the connection often runs over TCP/465.

The port has an unusual history. IANA originally assigned 465 to “smtps” in the late 1990s, then formally revoked the assignment in 1998 in favor of STARTTLS on port 587. Real-world deployment did not follow the revocation: mail server vendors and client developers continued to use 465 for implicit-TLS submission for the next two decades. In 2017, IANA re-registered the port as “submissions” (RFC 8314) to acknowledge what was already deployed. The current IANA listing therefore records “submissions” as the official service name, although nearly everyone still calls it SMTPS.

The architectural distinction from port 587 is the timing of the TLS handshake. SMTPS on 465 uses implicit TLS: the client opens a TLS connection first and then speaks SMTP inside the encrypted tunnel. SMTP Submission on 587 uses explicit TLS: the client connects in plaintext and issues a STARTTLS command to upgrade the connection. Both are equivalent for security purposes when properly configured. The choice between them is largely a matter of historical inertia at the mail provider.

Outbound TCP/465 from end-user devices to known mail provider addresses is normal and continuous on devices configured with email accounts. Inbound TCP/465 to a host that is not a designated mail server is unusual.

Port 465 also carries a second IANA assignment (“urd” for URL Rendezvous Directory for Source-Specific Multicast) which sees little real-world use. UDP/465 is registered for IGMPv3 lite, also rarely encountered.

About TCP Port 465

Port 465 is registered with the Internet Assigned Numbers Authority (IANA) for submissions. The IANA description reads: ‘Message Submission over TLS protocol’.

Security Considerations

Our data shows 30 IDS rules referencing port 465, all on TCP. The overwhelming majority of these rules detect a single vulnerability family: OpenSSL Heartbleed (CVE-2014-0160).

Heartbleed was disclosed in April 2014 and was one of the most impactful single TLS implementation bugs in internet history. The vulnerability was a missing bounds check in OpenSSL’s implementation of the TLS heartbeat extension that allowed an attacker to read arbitrary blocks of memory from a TLS server’s process. The leaked memory could contain anything the server happened to be holding: session keys, credentials, message contents, or even the server’s private key. Vulnerable code had been in production for over two years before discovery, and large numbers of internet-facing TLS services were affected. Port 465 attracted Heartbleed detection rules because it carries TLS traffic, not because the port itself was special; the same rules also appear on every other TLS-wrapped service in our dataset, including ports 636, 993, and 995. The rules are classified as reconnaissance because Heartbleed was an information-disclosure attack rather than a code-execution attack.

A single trojan-activity rule detects the Kriptovor malware family, a Windows trojan. The presence of malware-detection rules on port 465 reflects a broader pattern: outbound TLS-wrapped mail submission is an appealing covert channel for malware operators because the traffic blends into the constant stream of legitimate email submissions, making it harder to spot than connections to unusual ports.

Defensive practice for the SMTPS port itself centers on keeping TLS libraries current, enforcing modern cipher suites, and using authenticated submission with strong client credentials. The Heartbleed era is past, but the broader lesson stands: TLS is only as safe as the implementation behind it. For exfiltration risk, monitor for sustained outbound TCP/465 connections from end-user devices to destinations that are not the configured mail provider; those are uncommon and worth investigating.

Inbound TCP/465 to a host that is not a designated mail server is unusual. Outbound TCP/465 from end-user devices is normal when configured for email but should follow predictable destination patterns.

IDS Rule References

30 IDS / security rules reference TCP port 465. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.

Rule categories (top 3): attempted-recon (26), bad-unknown (3), trojan-activity (1).

Sample rule descriptions for TCP port 465:

• SERVER-OTHER OpenSSL SSLv3 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1.1 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL TLSv1.2 heartbeat read overrun attempt
• SERVER-OTHER OpenSSL SSLv3 large heartbeat response – possible ssl heartbleed attempt

Malware Rule References

A small share of the IDS rules that reference this port are malware related.

1 of the 30 IDS rules that reference TCP port 465 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.

Families observed (top 1): Kriptovor (1).

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).