Mail submission with STARTTLS — authenticated outgoing mail, TCP 587.
RFC 6409 reserves TCP 587 for message submission: mail arriving here is a submission from an authenticated user, not a relay from another mail server, so the server may apply its own rules (rewriting headers, requiring AUTH). The connection starts in cleartext and the client issues STARTTLS to upgrade. Postfix, Exim, and every hosted mail provider run it, and it is the port mail clients are configured with when they are not using 465. On a scan it identifies a mail submission agent.
Expose with care
Expected to be internet-facing for remote users, but require AUTH and enforce TLS before AUTH — a misconfigured 587 that accepts unauthenticated mail becomes an open relay.
$ openssl s_client -starttls smtp -connect MAIL_HOST:587 -quietSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.