SMTPs

SMTPS refers to the practice of securing the Simple Mail Transfer Protocol (SMTP) connection by wrapping the protocol in Transport Layer Security (TLS), such that the client and server negotiate or begin encrypted communication during connection setup. In classic SMTPS, the TLS handshake occurs immediately after establishing a TCP connection, before any SMTP protocol data is exchanged. This is known as implicit TLS. The common port associated with SMTPS is 465, though its use varies by vendor and system.

In contrast, SMTP over STARTTLS uses explicit TLS; the client connects on a submission or mail transfer port—commonly 587 or 25—and upgrades to TLS via a STARTTLS command during the SMTP session. STARTTLS provides the same encryption but after a protocol handshake has begun.

Historically, SMTPS on port 465 was registered for secure SMTP, but its status has been inconsistent as the standards evolved. Many modern mail deployments favor submissions on port 587 with STARTTLS, or opportunistic TLS on port 25, upgrading if supported, with explicit TLS policy.

Security considerations: TLS must be configured with strong cipher suites and valid certificates; servers should implement certificate validation, reject weak or expired certificates, and disable older TLS versions. Practitioners should be aware of the differences between implicit TLS (SMTPS) and explicit TLS (STARTTLS), and choose the approach that aligns with their mail infrastructure and security requirements.

In practice, SMTPS is encountered in legacy systems and some service providers, but current best practices emphasize STARTTLS on submission ports. Implementations should plan for compatibility and gradual migration where appropriate.