EmailTCP 587, 465 Encrypted
Port 587, 465: Submission
SMTP Submission
Clients sending mail to their own server: 587 with STARTTLS, or 465 with implicit TLS. Both should require authentication.
How attackers abuse it
- Compromised accounts used to send phishing from a trusted domain.
- Password spraying against submission endpoints.
How to defend it
- Require authentication and TLS.
- MFA and alerts on unusual sending volume.
Exam tip
If a question asks for the secure port for a mail client to send email, the answer is 587 (or 465).