{
  "port": 465,
  "protocol": "tcp",
  "service": "Submissions (SMTP over implicit TLS)",
  "oneLiner": "Mail submission with implicit TLS — the client's outgoing-mail port, TCP 465.",
  "whatItIs": "Mail servers (Postfix, Exim, Dovecot's submission proxy, hosted providers) listen on TCP 465 for authenticated message submission where TLS starts immediately on connect, before any SMTP greeting. RFC 8314 registered it as 'submissions' and recommends it over STARTTLS on 587 for new deployments; an earlier 'smtps' registration on this port was revoked, which is why the old name persists in configs. In Postfix it is the master.cf entry running smtpd with smtpd_tls_wrappermode=yes. It appears on a scan for any host that accepts mail from users, as opposed to server-to-server relay on port 25.",
  "exposure": {
    "verdict": "careful",
    "note": "Fine to expose deliberately for remote users since TLS is mandatory from the first byte, but it is an authentication endpoint, so it needs rate limiting and brute-force protection."
  },
  "checkCommand": "openssl s_client -connect MAIL_HOST:465 -quiet",
  "links": [
    {
      "title": "RFC 8314 — Cleartext Considered Obsolete: TLS for Email Submission and Access",
      "url": "https://datatracker.ietf.org/doc/html/rfc8314",
      "kind": "spec"
    },
    {
      "title": "Postfix TLS_README",
      "url": "https://www.postfix.org/TLS_README.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}