Common attacks and weaknesses
- Credential brute force.
Port 465: SMTPS
Email submission over implicit TLS.
465
How SMTPS works
EmailMail servers hand messages to each other over port 465, one hop at a time, until the recipient's server. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP · UDP
- Exposure risk
- 3/10 moderate if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned3 registered services
- Range
- Well-known (0-1023)
- Category
Is port 465 dangerous?
How to secure it
- Rate-limit authentication and require strong passwords.
IANA registry entries for port 465
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| igmpv3lite | 465 | UDP | IGMP over UDP for SSM | - | - |
| submissions | 465 | TCP | Message Submission over TLS protocol | RFC 8314 | 2017-12-12 |
| urd | 465 | TCP | URL Rendezvous Directory for SSM | - | - |
// source: IANA service name and port number registry
Which program uses port 465, and is it reachable?
Linux
sudo ss -ltnup 'sport = :465' # process listening on 465
sudo lsof -nP -i :465macOS
sudo lsof -nP -i :465
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 465 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 465 netstat -ano | findstr :465
From another machine
nmap -p 465 -sV <host> sudo nmap -sU -p 465 <host> nc -zv <host> 465
Block it in the firewall
sudo ufw deny 465/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 465" -Direction Inbound -LocalPort 465 -Protocol TCP -Action Block # Windows
What is port 465 used for?
Email submission over implicit TLS.
Is port 465 TCP or UDP?
Port 465 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 465?
It is rated 3/10 (moderate) when exposed to the Internet. Credential brute force. Rate-limit authentication and require strong passwords.
How do I check if port 465 is open?
On Linux run "ss -ltnup 'sport = :465'", on macOS "lsof -nP -i :465", and on Windows "netstat -ano | findstr :465" to see the local process. From another machine, "nmap -p 465 <host>" shows whether it is reachable.