TCP Port 587 – SMTP Submission (Authenticated Mail Sending)

Port 587 is the standard port for authenticated message submission, the dedicated channel email clients use to hand outgoing mail to a mail provider for delivery. When an application like Outlook, Thunderbird, or a phone’s built-in mail app sends a message, it connects to the provider’s submission server on TCP port 587, authenticates with a username and password, and uploads the message. The provider then takes responsibility for delivering it onward to the recipient’s mail server using SMTP on port 25 between servers.

Port 587 was introduced specifically to separate this client-to-server submission step from the older server-to-server transfer that runs on port 25. The current specification is RFC 6409, published in 2011, which formalized the longstanding practice that port 587 requires authentication, supports STARTTLS encryption, and is the appropriate port for residential and mobile users sending mail. Most residential internet providers block outbound port 25 from home networks but leave port 587 open precisely because it is the legitimate submission path.

Port 587 is the modern default for sending mail through almost every major mail provider, including Gmail, Outlook.com, Yahoo Mail, and most business email services. An encrypted alternative also exists on port 465, the legacy SMTPS port, which uses implicit TLS rather than the STARTTLS upgrade. Both are widely supported and produce the same end result.

Port 587 is also defined for UDP in the IANA registry, but UDP/587 is not used in practice. SMTP submission requires the reliable, ordered delivery that TCP provides.

About TCP Port 587

Port 587 carries the IANA assignment for submission. The IANA description reads: ‘Message Submission’.

Security Considerations

Port 587’s threat profile differs from older mail ports. Direct attacks against submission servers are not the primary concern, since the protocol requires authentication before any meaningful action and modern providers enforce TLS for the entire session. The dominant threat in our data is malware on already-compromised endpoints using port 587 to exfiltrate stolen data through legitimate-looking authenticated mail.

Our data shows 33 IDS rules referencing this port, with trojan-activity dominating at 25 of the 33 rules. The pattern is consistent: keyloggers and information stealers on compromised Windows machines authenticate to a mail server (often using credentials stolen from the same victim), then send captured passwords, keystrokes, screenshots, and clipboard contents as email attachments. Several specific families appear repeatedly in the rules, including the HawkEye keylogger (which alone accounts for many of the rules), the iSpy keylogger, and the Qbot banking trojan (MITRE S0650). The Kirts and SpamBanker families also appear in the data.

What makes port 587 attractive to this class of malware is the same property that makes it useful to legitimate users: it works through residential networks where outbound port 25 is blocked, and the traffic looks like ordinary mail submission. Network-layer detection is therefore difficult. The traffic is encrypted, the destination is a legitimate mail provider, and the volume per victim is small. Detection tends to come from endpoint products that catch the keylogger or stealer itself, or from the receiving mail provider noticing unusual sending patterns from a compromised account.

Port 587 traffic from end-user devices is normal and expected, since this is how mail clients send messages. Sustained outbound port 587 connections from a host that does not run a configured mail client, or sustained connections from a server that has no business sending mail, are worth investigating as potential indicators of credential-stealing malware.

IDS Rule References

29 IDS / security rules reference TCP port 587. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 5): trojan-activity (21), bad-unknown (4), attempted-admin (2), command-and-control (1), targeted-activity (1).

Sample rule descriptions for TCP port 587:

• MALWARE-CNC Win.Trojan.HawkEye keylogger exfiltration attempt
• MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt – clipboard and screenshot
• MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt – clipboard and screenshot
• MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt – clipboard and screenshot
• MALWARE-CNC Win.Trojan.Kirts initial registration

Malware Activity

Malware activity is frequently observed on this port.

23 of 29 IDS rules for TCP port 587 involve malware activity.

Families observed (top 8): HawkEye (6), Bancos (2), iSpy (2), SpamBanker (2), Espy (1), Fosniw.sap (1), Kirts (1), Kriptovor (1), and 3 more families.

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).