Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAn internet-facing TCP listener on port 587 is not, by itself, evidence of a misconfigured mail server. Port 587 is the standard port for email submission, so a mail platform that serves customers or applications on it will usually appear in internet-wide scans. The widely cited figure of nearly 11 million records is a count of matches in one search engine’s index, taken on one day. It does not count open relays, vulnerable servers, or distinct organizations. What it does justify is a review of your own submission endpoints against a short list of controls defined in the IETF standards.
What the 10,990,138 figure actually measures
The figure comes from a DEV Community article by OnaEiuspkz, published on 28 September 2026. The author ran the ZoomEye query port=587 && service="smtp" and reported 10,990,138 records as of 26 September 2026 at 02:43:38 UTC. The author states the search used the “all” subtype with a page size of 1, and that the total was read from the result count.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Tripp Lite SRSCREWS Rack Enclosure Server Cabinet Threaded Hole Hardware Kit | $23.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
That is a snapshot of an index, and it has specific limits that the article itself acknowledges:
| Question | What the figure can support | What it cannot support |
|---|---|---|
| How many hosts answered on TCP 587 with an SMTP-like banner? | An approximate index count for that date | A verified live host count today |
| Are these mail servers? | That the scanner classified responses as SMTP | Confirmation of the software, role, or configuration behind each response |
| Are these open relays? | Nothing | Any relay behavior at all, since the figure is not a relay test |
| Are these vulnerable? | Nothing | Any weakness, including missing authentication or cleartext acceptance |
| How many organizations are affected? | Nothing | An organization or country count; no deduplicated host list, ownership breakdown, or geographic breakdown is given |
Two further limits matter for interpretation. The service label is inferred from a response, not read from configuration. The index can also contain honeypots and hosts that existed only briefly. A reachable endpoint does not show whether it requires authentication, so the number tells you about visibility, not posture.
#1 Best Overall
- Threaded hole hardware kit - 50 each #12-24 screws
- Fastens equipment to threaded hole rack mount rails
- Compatible with all #12-24 threaded hole racks
What port 587 is for
RFC 6409, “Message Submission for Mail,” reserves port 587 for email message submission: “Port 587 is reserved for email message submission as specified in this document.” Submission is the step where a mail user agent or an application hands a message to a Message Submission Agent (MSA), which is the server that accepts mail from authorized users. Relay between mail servers is a different step and continues to use port 25. The two roles have different policy needs, and treating them as the same service is the root of most confusion about what an open port 587 means.
| Port | Usual role | Who connects | Typical protection |
|---|---|---|---|
| 25 | Server-to-server relay (MTA to MTA) | Other mail servers | Recipient checks, anti-spam, and STARTTLS where supported |
| 587 | Message submission | Mail clients and applications | SMTP AUTH, required TLS, and per-account controls |
| 465 | Message submission over implicit TLS | Mail clients and applications | TLS from the first byte, plus SMTP AUTH |
What an exposed 587 listener does and does not tell you
When a scan finds port 587 open, you can conclude only that something accepts TCP connections there and returns a response that looks like SMTP. You cannot conclude the following from that alone:
- Whether the server requires authentication before accepting mail.
- Whether it accepts mail for external recipients from unauthenticated senders.
- Whether it offers or requires TLS, or whether credentials can be sent in cleartext.
- Whether the listener belongs to your organization, a hosting provider, or an unrelated party.
Each of those requires a check on an endpoint you own. The next section sets out what the standard expects those checks to find.
The authentication rule in RFC 6409
RFC 6409 is direct about the default behavior of a submission server. An MSA “MUST, by default, issue an error response to the MAIL command if the session has not been authenticated using [SMTP-AUTH], unless it has already independently established authentication or authorization (such as being within a protected subnetwork).”
The exception matters. The standard does not require SMTP AUTH on every connection; it allows authorization to be established by another means, such as a connection from a protected internal network. So the correct test is not “does the server ask for a password?” but “if an unauthenticated session reaches MAIL FROM, is there a documented and enforced basis for accepting it?” If the answer is no, the server is not following the default.
Transport protection: STARTTLS on 587 or implicit TLS on 465
RFC 8314, “Cleartext Considered Obsolete: Use of Transport Layer Security (TLS) for Email Submission and Access,” which updates RFC 6409, sets the transport requirement: “TLS version 1.2 or greater be used for all traffic between MUAs and Mail Submission Servers, and also between MUAs and Mail Access Servers.” It recommends discouraging and phasing out cleartext mail protocols as soon as practicable.
The standard prefers implicit TLS for submission. It also describes a transition period in which clients and servers support both STARTTLS on port 587 and implicit TLS on port 465. RFC 8314 states that the two approaches do not differ significantly in security properties when implementations are correct and both sides require successful TLS negotiation before submission. The qualifier is important: a STARTTLS listener that offers TLS but still accepts AUTH or MAIL in cleartext is not equivalent to one that refuses them.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Axis | STARTTLS on 587 | Implicit TLS on 465 |
|---|---|---|
| Standard position (RFC 8314) | Permitted during the transition period | Preferred |
| TLS begins | After a plaintext EHLO and STARTTLS exchange | Immediately on connect |
| Security when correctly configured | Comparable, per RFC 8314, when TLS is required before submission | Comparable, under the same condition |
| Main failure risk | Server offers STARTTLS but does not require it, so clients can send credentials in cleartext | Client does not support implicit TLS |
| Client compatibility | Widely supported | Supported by most current clients, but confirm for each client in use |
Neither port is inherently safer in all configurations. The question to answer is whether TLS is mandatory before credentials or message content are sent.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to check your own submission endpoints
Run these checks only against hosts and address ranges you own or are explicitly authorized to assess. Do not attempt authentication against hosts you do not control, and do not treat a search-engine listing as permission to test.
- Reconcile the inventory. Scan your own address ranges for ports 25, 465, and 587, then compare the results with the submission hostnames your mail platform documents. Anything open that is not on the list needs an owner. For example:
nmap -Pn -sV -p 25,465,587 --open 203.0.113.0/28(replace with your own range). The scan shows what listens and what banner it returns; it does not show policy. - Confirm the TLS path on 587. Connect, issue EHLO, and look for the STARTTLS capability:
openssl s_client -starttls smtp -connect mail.example.net:587 -crlf EHLO check.example.netThen check that the server refuses MAIL FROM before the TLS upgrade. A correctly configured server returns a 5xx rejection, and the exact code and wording vary by product. Also check that AUTH does not appear in the plaintext EHLO response.
- Confirm implicit TLS on 465, if offered. Connect directly with TLS:
openssl s_client -connect mail.example.net:465 -crlfCheck the certificate name matches the hostname and that the certificate chain validates. A failed handshake here is not necessarily a fault if 465 is intentionally disabled, but record the decision.
- Test the authentication default, without sending mail. On an endpoint you own, after TLS is established, send EHLO, then an unauthenticated
MAIL FROMandRCPT TOusing a test address on a domain you control. Stop before DATA so no message is transmitted. A correctly configured MSA rejects the unauthenticated session at MAIL or RCPT unless the access basis is documented, such as a protected subnetwork. - Verify sending controls. Confirm that per-account sending limits exist, that successful submissions are logged with the authenticated identity, and that stored client credentials, such as those in applications, configuration files, or secrets stores, are protected and rotated.
Reading the results
Use the table below to decide what each finding means and what to do next. The rows describe patterns, not evidence that any particular host is misconfigured.
| Observation on an endpoint you own | What it indicates | Next action |
|---|---|---|
| 587 open, no STARTTLS offered, AUTH advertised in plaintext | Credentials could be sent unencrypted | Enable STARTTLS and require it before AUTH; disable cleartext AUTH |
| STARTTLS offered, but MAIL accepted before TLS or without AUTH | TLS and authentication are optional, which contradicts the RFC 6409 default | Make TLS mandatory before submission and require AUTH or a documented authorization basis |
| Unauthenticated RCPT to an external test address accepted | The server may relay for unauthenticated senders | Treat as urgent; restrict recipients to authenticated users and review relay rules |
| 587 reachable only from internal ranges | Access may rest on a protected subnetwork | Confirm that the basis is documented and that the subnetwork boundary is enforced |
| Host appears in an index but not in your inventory | Could be a third party, a retired host, or an index artifact | Check ownership and DNS records; do not test it without authorization |
| 465 and 587 both enforce TLS before submission | Consistent with the RFC 8314 transition approach | Confirm that client configurations use the intended port |
Is an open port 587 the same as an open relay?
No. An open relay accepts mail from unauthenticated senders and forwards it to external recipients. Whether a server does that is a property you test on your own endpoint, as in step 4 above. A reachable port, a banner, or an index entry does not establish relay behavior, weak authentication, or plaintext acceptance.
Source: DEV Community, “Nearly 11 Million Submission Endpoints on Port 587: The Mail Path That Is Rarely Reviewed,” 28 September 2026. RFC 6409 and RFC 8314 are IETF Standards Track documents from the RFC Editor.
Because the index count changes, verify any new figure from the search engine on the day you cite it, and state the query date with it.
The Bottom Line
An exposed port 587 is a reason to inventory and test, not a finding. Confirm that every owned submission endpoint requires TLS before credentials or messages are sent, requires SMTP AUTH or a documented authorization basis before accepting MAIL, and logs authenticated submissions. Those three checks decide whether the mail path is configured safely.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
