Port 587 (SMTP Submission) is targeted for account takeover, credential stuffing, and abuse of authenticated mail relays to send spam or phishing. Attackers look for weak authentication and poorly controlled client submission. Defenders should require authenticated encrypted submission, restrict relay rights, and watch for abnormal message volumes, failed logins, and new sender patterns.
Why Port 587 is a target, and what attackers are trying to do
Port 587 exists for authenticated mail submission, so it is attractive anywhere attackers can turn a legitimate user path into outbound abuse. The usual goal is not to break SMTP itself, but to steal or reuse credentials, then send spam, phishing, or malicious attachments through a trusted relay. That makes submission abuse a blend of account takeover and mail-delivery misuse.
Attackers commonly probe whether the service accepts weak passwords, reused credentials, or legacy client settings that make login easier to brute-force. They also look for environments that accept submission without strong TLS protection or that allow broad relay rights once a user authenticates. Where that happens, the mail server becomes a high-trust outbound channel rather than a controlled submission endpoint. For related port and protocol hardening patterns, see the Network Ports and Protocols Security Guide.
Port 587 is also a natural target for credential-stuffing campaigns because successful login often gives immediate delivery capability without needing deeper system compromise. In practice, the attacker only needs one usable mailbox or service credential to produce large volumes of spam or phishing from a trusted IP or domain reputation. If you are looking for a broader breach pattern, the State of NHI & AI Agent Breach Report 2026 is useful for understanding how stolen credentials are turned into downstream abuse.
How submission abuse shows up in the mail stack
The clearest sign of abuse is a mismatch between normal user behaviour and message output. A single account that suddenly sends at unusual times, to unfamiliar recipients, or at a much higher volume than normal is often the first indicator. Failed logins, repeated authentication attempts from new geographies, and a rise in sender diversity from one mailbox are all consistent with Port 587 abuse.
Another pattern is relay misuse rather than outright mailbox takeover. In that case, the attacker authenticates successfully and then uses the submission path to send mail that appears legitimate to downstream filters because it comes through approved infrastructure. This is why submission logs, authentication logs, and message-queue telemetry need to be reviewed together, not separately. A trusted submission channel can still be the delivery mechanism for spam, phishing, and business-email-compromise style fraud.
Defenders should also watch for configuration drift that weakens the intended trust boundary. If client submission accepts weak authentication methods, if TLS is optional, or if relay authorization is too broad, the service may be technically “working” while still being easy to abuse. Port 587 should be treated as a controlled user entry point, not as a convenience port for any authenticated sender.
Hardening Port 587 against takeover and relay abuse
The practical defense is to make authenticated submission both strongly authenticated and tightly bounded. Require encrypted submission, enforce modern authentication where possible, and ensure relay permission is limited to the exact identities that need it. The server should not grant outbound delivery rights simply because a client connected successfully.
Submission controls work best when they are paired with mailbox and account hygiene. If a user account is compromised, the attacker inherits a trusted send path immediately, so password quality, MFA where supported, and prompt session invalidation matter as much as SMTP configuration. Mail systems also benefit from sender policies, rate limiting, and alerting on first-time recipient patterns so abuse is visible before reputation damage spreads.
When a compromised submission account is suspected, treat it like an access incident, not only a mail issue. Look for mailbox rule tampering, forwarding changes, unusual login sources, and other signs that the account may be used for persistence or message diversion. The CISA cyber threat advisories page is useful for tracking the broader abuse patterns that often accompany credential theft and mail-based intrusion.
Risk and Threat Considerations
Port 587 abuse matters because the trust inherent in authenticated submission can be converted into spam, phishing, and reputation damage very quickly. Once an attacker has valid submission access, the service may look like normal business mail while actually being used as an outbound abuse platform.
Failure mechanism: Weak or reused credentials, permissive relay rules, or inadequate submission monitoring let an attacker authenticate as a legitimate sender and push messages through trusted infrastructure.
Impact: The organisation can suffer account takeover, mail-domain reputation loss, phishing delivery, and secondary compromise of recipients who trust the messages.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Port 587 abuse often starts with stolen or weak credentials. |
| AC-3 — Access Enforcement | Relay rights and sender permissions must be enforced on authenticated submission. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing login and message activity for abnormal sending patterns. | |
| Recommendation — Manage submission credentials tightly and rotate or revoke them when abuse is suspected. Enforce least-privilege relay permissions for mail submission identities. Review submission and message logs for unusual send volume and failed logins. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Mail submission abuse is reduced by limiting who can authenticate and relay mail. |
| Recommendation — Restrict mail submission access to approved users and service identities. | ||
| OWASP ASVS | V6 — Authentication | Authenticated submission hinges on strong login and session protections. |
| Recommendation — Require strong authentication for any client that can submit mail. | ||
Practitioner Guidance
What to verify: Confirm that authenticated submission is mandatory, relay rights are scoped to the minimum set of users and devices, and failed-login alerts are tied to the mail security team. A “working” SMTP submission service is not enough if it can be used to send at scale without meaningful guardrails.
What to measure: Track failed authentications, successful logins from new locations, per-account message volume, unique recipient counts, and sudden changes in sender behaviour. Those signals usually surface abuse earlier than content inspection alone.
Practitioner takeaway: Treat Port 587 as a privileged outbound channel, not a benign transport port, because the main control objective is preventing legitimate submission access from becoming an abuse path.