Question About ports 465 and 587

[emilitingo]

About this image:

If I open port 587, will port 465 stop working? Or will both ports be available and can I use either port as needed?

If I change to port 587, will I have to reconfigure my email managers later?

About this picture:


It will automatically change this setting and I won't have to do anything? or should I make the changes manually later in plesk?

I am using Plesk Obsidian Web Host Edition

Thanks for the support

 

[IgorG]

If I open port 587, will port 465 stop working? Or will both ports be available and can I use either port as needed?

Before enabling 587 port:

root@friendly-banzai:~# lsof -i tcp:465
COMMAND     PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
master  3516935 root  114u  IPv4 67160597      0t0  TCP *:submissions (LISTEN)
master  3516935 root  115u  IPv6 67160598      0t0  TCP *:submissions (LISTEN)

root@friendly-banzai:~# lsof -i tcp:587
root@friendly-banzai:~#

After enabling 587 port:

root@friendly-banzai:~# lsof -i tcp:465
COMMAND     PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
master  3632049 root  114u  IPv4 69460309      0t0  TCP *:submissions (LISTEN)
master  3632049 root  115u  IPv6 69460310      0t0  TCP *:submissions (LISTEN)

root@friendly-banzai:~# lsof -i tcp:587
COMMAND     PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
master  3632049 root  129u  IPv4 69468761      0t0  TCP *:submission (LISTEN)
master  3632049 root  130u  IPv6 69468762      0t0  TCP *:submission (LISTEN)

So, port 587 will be added additionally to 465 port.

It will automatically change this setting and I won't have to do anything?

I checked and found that nothing changed in this tip.
In conclusion - nothing should be additionally configured, just port 587 will be added additionally.

 

[emilitingo]

I didn't think it would be so easy. I will try it and comment later on the results
Thanks for the help

 

[defcon8]

Any info on how to change the "tip" in the UI? We want our users to use 587 by default...

 

[Kaspar@Plesk]

Any info on how to change the "tip" in the UI? We want our users to use 587 by default...

Add the configuration to panel.ini file. This only changes the port shown in the UI, not any server configuration.

[mail]
clientConfig.smtpPortEncrypted = 587

 

[defcon8]

@Kaspar@Plesk thanks that was very helpful!

 

[mow]

We want our users to use 587 by default...

Why? 465 is safer because you can't accidentally use it without SSL/TLS.

 

[ChristophRo]

Not really....
Plesk/Postfix enforces TLS/StartTLS for connections on port 587 as well

Port 587 is the port to use nowadays.
465 is a legacy construct that may get obsolete and vanish in the future

 

[mow]

But at least with 465 you know it can't connect unencrypted, whereas with 587 you have to rely on the server to enforce (and the client demand) STARTTLS before anything else, which makes a MITM attack possible.

 

[defcon8]

For some reason, there is an issue with communication to our port 465. It takes roughly 30 seconds (after socket connection is established) before the server throws the welcome message to the client. This is problematic for some mail clients. We yet have to find the cause. Communication on 587 works straight away.

 

[websavers]

@Kaspar@Plesk when the submission port (587) is enabled, that should become the default in all guides, not 465. We shouldn't have to use a panel.ini override to do that.

In other words, keep it at 465 if submission port is not enabled, and force it to 587 when submission port is enabled.

 

[websavers]

For some reason, there is an issue with communication to our port 465. It takes roughly 30 seconds (after socket connection is established) before the server throws the welcome message to the client. This is problematic for some mail clients. We yet have to find the cause. Communication on 587 works straight away.

I'm not certain if that's exactly our issue, but we do have clients reporting issues with some mail apps on 465 that work fine with 587, so that probably is the issue. Another reason why, when 587 is enabled in Plesk, it should be the default in all guides.

 

[websavers]

But at least with 465 you know it can't connect unencrypted, whereas with 587 you have to rely on the server to enforce (and the client demand) STARTTLS before anything else, which makes a MITM attack possible.

Explain. We're talking in the context of Plesk servers. By default Plesk servers require STARTTLS on 587. So in the context of Plesk servers, how is that relevant?