{
  "port": 587,
  "protocol": "tcp",
  "service": "Submission (SMTP with STARTTLS)",
  "oneLiner": "Mail submission with STARTTLS — authenticated outgoing mail, TCP 587.",
  "whatItIs": "RFC 6409 reserves TCP 587 for message submission: mail arriving here is a submission from an authenticated user, not a relay from another mail server, so the server may apply its own rules (rewriting headers, requiring AUTH). The connection starts in cleartext and the client issues STARTTLS to upgrade. Postfix, Exim, and every hosted mail provider run it, and it is the port mail clients are configured with when they are not using 465. On a scan it identifies a mail submission agent.",
  "exposure": {
    "verdict": "careful",
    "note": "Expected to be internet-facing for remote users, but require AUTH and enforce TLS before AUTH — a misconfigured 587 that accepts unauthenticated mail becomes an open relay."
  },
  "checkCommand": "openssl s_client -starttls smtp -connect MAIL_HOST:587 -quiet",
  "links": [
    {
      "title": "RFC 6409 — Message Submission for Mail",
      "url": "https://datatracker.ietf.org/doc/html/rfc6409",
      "kind": "spec"
    },
    {
      "title": "RFC 8314 — TLS for Email Submission and Access",
      "url": "https://datatracker.ietf.org/doc/html/rfc8314",
      "kind": "spec"
    },
    {
      "title": "Postfix TLS_README",
      "url": "https://www.postfix.org/TLS_README.html",
      "kind": "official-docs"
    }
  ]
}