Mail submission with implicit TLS — the client's outgoing-mail port, TCP 465.
Mail servers (Postfix, Exim, Dovecot's submission proxy, hosted providers) listen on TCP 465 for authenticated message submission where TLS starts immediately on connect, before any SMTP greeting. RFC 8314 registered it as 'submissions' and recommends it over STARTTLS on 587 for new deployments; an earlier 'smtps' registration on this port was revoked, which is why the old name persists in configs. In Postfix it is the master.cf entry running smtpd with smtpd_tls_wrappermode=yes. It appears on a scan for any host that accepts mail from users, as opposed to server-to-server relay on port 25.
Expose with care
Fine to expose deliberately for remote users since TLS is mandatory from the first byte, but it is an authentication endpoint, so it needs rate limiting and brute-force protection.
$ openssl s_client -connect MAIL_HOST:465 -quietSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.