Support for SMTP Port 587

[ivansalloum]

I appreciate the robust capabilities of Postal as an open-source mail delivery platform. I would like to discuss the potential for Postal to support additional SMTP ports, specifically port 587, alongside the default port 25.

Port 587 is widely recognized as the standard port for email message submission with explicit TLS encryption via STARTTLS. This port is commonly used for client-to-server communications and is often preferred due to its support for secure transmission.

While I understand that Postal supports explicit TLS with STARTTLS on port 25, integrating support for port 587 could enhance compatibility with various email clients and services that default to this port for secure email submission.

I have noticed some confusion in discussions regarding the nature of these ports, particularly the misconception that port 587 uses implicit TLS. To clarify, port 587 employs explicit TLS via STARTTLS, initiating a secure connection upon the client's request. And since Postal supports explicit TLS with STARTTLS on port 25, port 587 should also function seamlessly and integrate easily.

Given that Postal's SMTP server port can be configured through the postal.yml file or the PORT environment variable, I am interested in understanding if there are specific reasons for the default limitation to port 25 and whether there are plans to officially support port 587 in future releases.

[pdifeo]

I solved it by redirecting port 587 from the firewall (or iptables) to port 25. That way both work.

[ivansalloum]

I’ve seen several people mention this approach in discussions here and here. Could you share how you set it up?

While this workaround can make port 587 work with Postal, there are some potential downsides to consider.

• Authentication Issues:

  • Port 587 is meant for email submission (client-to-server) and typically requires authentication.
  • Port 25 is generally used for mail relay (server-to-server) and may not require authentication.
  • If Postal does not enforce authentication on port 25, redirecting 587 to 25 could allow unauthenticated email submissions, which can be a security risk.

• STARTTLS and Encryption Handling:

  • Port 587 is designed for explicit TLS with STARTTLS, meaning the connection starts unencrypted and upgrades to TLS upon request.
  • Port 25 also supports STARTTLS but may not enforce it, leading to potential mismatches in encryption expectations.
  • Some email clients might expect a strict STARTTLS requirement on 587, and if Postal does not enforce this properly, there could be compatibility issues.

• Some Email Clients Might Reject It:

  • Certain mail clients and services check whether they are actually connected to port 587.
  • A simple firewall redirection does not change the fact that the actual SMTP service is running on port 25, which may cause issues with some clients.

And since it's 2025 and both ports support explicit TLS, there’s no reason why Postal shouldn’t natively support port 587.