Port 465 — SMTPS

Q: How do I check if port 465 is open?

Locally, sudo lsof -i :465 on macOS or Linux, or netstat -ano | findstr :465 on Windows. From outside, nc -zv host 465 tells you whether anything answers.

TCP well-known

What runs on port 465

Mail submission over implicit TLS.

Implicit-TLS mail submission. Its history is unusual: originally assigned for SMTPS, then deprecated in favour of STARTTLS on 587, then formally reinstated in 2018 because implicit TLS turned out to be the safer design — there is no plaintext phase for an attacker to strip. Both 465 and 587 are correct today; 587 has wider support in older clients.

Security considerations

Deprecated, then un-deprecated. Port 587 with STARTTLS is the more widely supported choice.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :465
sudo ss -lntp | grep :465

# Windows
netstat -ano | findstr :465
Get-NetTCPConnection -LocalPort 465

# is it reachable from outside?
nc -zv example.com 465
curl -v telnet://example.com:465

Freeing the port

# find the process, then stop it
sudo lsof -ti :465 | xargs kill        # Linux / macOS
netstat -ano | findstr :465            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Only on a mail server. If this port is open on something that is not intentionally handling mail, you may be running an open relay — which will get the IP blacklisted quickly.

Opening or blocking port 465

Finding the port is usually the first half of the job. Start narrow — the second rule is there for services that genuinely serve the public, and most do not:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 465 proto tcp
sudo ufw allow 465/tcp                   # only if it genuinely serves the public

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=465 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 465 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 465 -j DROP

# Windows
New-NetFirewallRule -DisplayName "SMTPS 465" -Direction Inbound -Protocol TCP -LocalPort 465 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Port	465
Protocol	TCP
Service	SMTPS
Range	Well-known (0–1023) — binding requires root on Unix

Frequently asked questions

What is port 465 used for?

Mail submission over implicit TLS.

Is it safe to open port 465?

Deprecated, then un-deprecated. Port 587 with STARTTLS is the more widely supported choice.

How do I check if port 465 is open?

Locally, sudo lsof -i :465 on macOS or Linux, or netstat -ano | findstr :465 on Windows. From outside, nc -zv host 465 tells you whether anything answers.

Why do I get "address already in use" on port 465?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :465 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers