Port 587 Exposed: What Internet Mail Submission Means

Nearly 11 million port 587 records exposed on the internet means that a very large number of mail servers are accepting message submissions from anywhere on the internet, not just from their own users. This is a serious security and spam problem because port 587 is the standard port for email submission, and when it is left open to the whole internet without proper authentication, anyone can use it to send email through that server. This article explains what port 587 is, why its exposure matters, how attackers exploit it, and what you can do about it.

What Is Port 587 and Why Does It Exist?

Port 587 is the TCP port designated for email message submission, as defined in RFC 6409 (and earlier RFC 2476). It is the port that email clients (like Outlook, Thunderbird, or a phone’s mail app) use to send outgoing email through a mail server. The key difference between port 587 and the older port 25 (SMTP) is that port 587 is meant for authenticated submission: the client must log in with a username and password before the server will accept the message. Port 25 is for server-to-server relay, where mail servers exchange messages with each other.

In practice, most email providers require clients to use port 587 (or sometimes 465 for implicit TLS) for sending. This separation allows network administrators to block port 25 for regular users while still allowing them to send mail via 587, and it provides a clear place to enforce authentication and rate limiting.

What Does “Exposed� Mean on the Internet?

When security researchers talk about “exposed� ports, they mean that a network service is reachable from the public internet without being restricted by a firewall or network address translation (NAT). For example, a mail server behind a home router might be configured to forward port 587 to an internal machine, making it accessible from anywhere. If that service does not require authentication, or if it accepts connections from any IP address, it is considered exposed.

An exposed port 587 does not automatically mean the server is vulnerable, but it does mean that anyone on the internet can attempt to connect to it. The danger comes when the server is misconfigured—for example, if it allows open relay (accepting mail for any recipient) or if it has weak or default credentials. Even with authentication, an exposed port can be targeted by brute-force attacks that try many passwords.

Why Would an Attacker Target Port 587?

Attackers scan the internet for open port 587 for several reasons:

• Spam relay: If the server allows unauthenticated relay, attackers can send thousands of spam emails through it, hiding their own identity and using the victim’s server resources.
• Credential theft: An exposed port invites brute-force login attempts. If an attacker guesses a valid username and password, they can send mail as that user or access other services that share the same credentials.
• Phishing infrastructure: Compromised mail servers are used to send phishing emails that appear to come from a legitimate domain, increasing the chance that recipients will trust them.
• Resource abuse: Even without full compromise, an attacker can use the server’s bandwidth and CPU to send bulk email, causing performance issues and potentially getting the server’s IP blacklisted.

How Do Attackers Discover Exposed Port 587?

Attackers use port scanning tools like Nmap or masscan to scan large ranges of IP addresses for open ports. They look for any port that responds to a TCP handshake, and then they probe the service to see what it is. For port 587, they might send a simple SMTP command like EHLO to see if the server responds with a banner. If it does, they know it is a mail submission service and can then try to authenticate with common usernames and passwords or test for open relay.

Public databases like Shodan and Censys continuously scan the internet and index exposed services. Security researchers and attackers alike can search these databases for port 587 and find thousands of potential targets. The “nearly 11 million records� likely comes from such a scan, counting every IP address that responded on port 587 during a certain period.

How to Check if Your Own Port 587 Is Exposed

If you administer a mail server, you can check whether port 587 is exposed by using an online port checker or a local tool like netstat or nmap. Here are steps you can take:

1. Determine your public IP address (e.g., by visiting a site that shows your IP).
2. Use an online port checker or a tool like nmap -p 587 your-ip from an external network to see if the port is open.
3. If the port is open, check your firewall rules to see if you intended to allow external access. If not, block it.
4. If you need remote access to your mail server, ensure that it requires strong authentication and uses TLS encryption.

Even if you don’t run a mail server, you might have a home router that forwards port 587 to a device. Check your router’s port forwarding settings and disable any rules you don’t recognize.

Common Misconceptions About Port 587

One common misconception is that port 587 is inherently insecure. It is not—it is a standard, secure way to submit email when configured correctly. The problem is misconfiguration. Another misconception is that using port 587 means you don’t need encryption. In fact, you should always use STARTTLS on port 587 to encrypt the connection between your client and server. Finally, some people think that blocking port 25 is enough to stop spam. While that helps, attackers simply move to 587 if it is open and unauthenticated.

How to Protect a Mail Server on Port 587

If you run a mail server that uses port 587, follow these best practices:

• Require authentication for all submission attempts. Reject any connection that does not log in.
• Use strong passwords and consider two-factor authentication for mail accounts.
• Enable TLS (STARTTLS) to encrypt credentials and message content.
• Implement rate limiting to prevent brute-force attacks.
• Restrict access by IP address if possible, especially for administrative accounts.
• Monitor logs for unusual activity, such as repeated failed logins or a sudden increase in outbound mail.
• Keep your mail server software up to date to patch known vulnerabilities.

Frequently Asked Questions

Q: Is port 587 the same as SMTP?
No. Port 25 is the traditional SMTP port for server-to-server relay. Port 587 is the message submission port for authenticated clients. They use the same protocol (SMTP) but serve different purposes.

Q: What is the difference between port 587 and 465?
Port 587 is for submission with STARTTLS, where the connection starts plain and then upgrades to TLS. Port 465 is for implicit TLS, where the connection is encrypted from the start. Both are used for client submission, but 587 is more common.

Q: Can I use port 587 to send email without a password?
No, you should not. Port 587 is designed for authenticated submission. Sending without a password is a sign of an open relay, which is a security risk and will likely be blocked by other servers.

Q: How do I know if my email server is an open relay?
You can test it by trying to send an email to a recipient outside your domain without authenticating. If the server accepts it, it is an open relay. There are online tools that can perform this test.

Q: What should I do if I find an exposed port 587 on my network?
First, determine if it is intentional. If not, block it at the firewall. If it is intentional, ensure that it requires authentication, uses TLS, and has strong passwords. Check logs for any signs of unauthorized access.

Q: Does an exposed port 587 mean my email is being read?
Not necessarily. It means that someone could potentially connect to your mail server, but they would still need valid credentials to read or send email. However, it increases the risk of a brute-force attack, so it is best to close it if not needed.

Related

• Ring Wired vs Battery Doorbells: Which Should You Choose?
• Extension Cord vs Power Strip: Which Is Safer?
• Desk Lamp Brightness and Color Temperature for Studying