Understanding EMail Ports
| ~4 minute read
When I first configured my EMail server I used a guide by Linode to get it working, and it asked me to allow a bunch of ports just to get my mailserver working. I just follwed the guide line-by-line not knowing what all of these things did. Its common knowledge that the SMTP protocol uses port 25, and I need to open ports for POP3 and IMAP, but most guides ask you to unblock 7 different ports! I recently figured out I don't even need all those, and maybe you don't too.
Ports used by the EMail system
The SMTP Ports
The SMTP protocol is mostly only known for the infamous port 25 which is blocked by most ISPs to fight spam. But, in reality, it makes use of 3 ports:
Port 25
Port 25 was originally the only port that SMTP used. It was used for both client-server
and server-server connections. But, as the internet grew, a lot of spam was being
generated through this port so the SMTP traffic was split into two functions:
Submission and Relay. Port 25 also only supports unencrypted traffic.
Nowadays, Port 25 is only used for "Relay" i.e server to server transfer of mail and doesn't require authentication. If you are a client you won't need access to port 25 at all.
Port 587 (STARTTLS)
The port 587 was assigned for the submission function. The client will "submit" an email to the mail server and the server will "relay" the mail to another server (if needed) through port 25.
Initially the connection is unencrypted but then it is upgraded through the STARTTLS
command sent by the client, to establish an encrypted SSL/TLS tunnel. This port was
formally introduced as a standard in 1998.
Port 465 (SSL/TLS)
Port 465 is pretty interesting. It is also used for mail submission but it uses "Implicit SSL" (traffic is encrypted from the very beginning) unlike STARTTLS where the connection needed to be explicitly upgraded. This was registered by IANA in 1997.
So, port 465 (SSL/TLS) became the way to send secure email, but when STARTTLS was formally released as a standard, the SSL/TLS method suddenly became the unofficial way to send secure messages. Still, people kept using it so through a confusing timeline, it finally made its way into the standard in 2018.
If you have the choice, I'd recommend using this port as it's more secure than STARTTLS.
Which Submission port to choose?
If you're confused, you can configure your server with both and allow both ports in your firewall because some legacy applications may only support one or the other port. On a modern system, you can also have either one of them unblocked in the firewall.
In a private VPS, I'd recommend only allowing port 465 (SSL/TLS) and blocking 587 through your firewall to minimise the attack surface.
Ports used by IMAP
IMAP4 uses ports 143 (Unencrypted/STARTTLS connection) and 993 for IMAPS (SSL/TLS encrypted). I'd recommend only using 993 and blocking 143 in your server's firewall (if possible).
Ports used by POP
POP3 uses ports 110 (Unencrypted/STARTTLS connection) and 995 for POP3S (SSL/TLS encrypted). I'd recommend only using 995 and blocking 110 in your server's firewall (if possible).
So, what configuration to use?
A complete mailserver would use 7 different ports for different purposes. But in many cases, -especially in a private mailserver with only a few users- you only need to allow 3 to 4 ports. This tidies up your firewall rules quite a bit.
In my case, I only have port 25 (mandatory for all servers), 465 (SSL/TLS), and 995 (IMAPS) allowed. The other four are blocked since I don't really use STARTTLS, or POP, and definitely not the insecure version of IMAP.
There, from 7 firewall rules I have only 3 now! I get less spooked when I run ufw status now
which is nice. I wasn't using all that other shit anyways.
P.S. If you have multiple users on your server, you should probably ask them before randomly disabling some service.