Is it safe to expose Port 587 (SMTP Submission) to the internet?

What makes Port 587 safe to expose?

Port 587 is intended for mail submission, not open relay. The security question is therefore less about whether the port is public and more about whether the service behind it enforces authenticated submission, encryption in transit, and a policy that prevents unauthenticated sending. If those controls are weak, the exposed port becomes an abuse surface rather than a standard mail access point.

For operators, the practical distinction is between a submission endpoint and a general SMTP listener. A correctly configured submission service should accept messages from authenticated users only, apply submission-specific policy, and refuse unauthenticated relay. Network Ports and Protocols Security Guide is useful context for separating common port exposure from insecure protocol use.

Port 587 is not inherently dangerous when the organisation controls who can use it and how. It becomes unsafe when the same endpoint is reachable from the internet but lacks strong login protection, TLS enforcement, or relay restrictions, because then it can be abused for spam, phishing, and account-based abuse at scale.

What failure modes matter most?

The main failure mode is treating submission as if it were a trusted internal path. If anonymous relay is possible, attackers can send mail through your infrastructure directly. If credentials are weak or reused, an exposed submission service can become a brute-force target and a high-value abuse channel for compromised accounts.

Another common failure is partial hardening, where encryption is enabled but authentication is weak, or authentication exists but rate controls are absent. In that case, the service may still be reachable and technically “secured,” yet remain operationally exposed to credential stuffing, password spraying, and abuse by hijacked accounts. The State of NHI & AI Agent Breach Report 2026 shows how often attackers rely on stolen credentials and abuse paths once they obtain valid access.

A third failure mode is inadequate monitoring. If you do not alert on unusual submission volume, repeated authentication failures, or sudden changes in sending patterns, a compromised mailbox can be used to distribute spam or phishing before anyone notices.

How should teams decide whether to publish it?

Publish Port 587 only when the server is configured for submission-only use, requires encryption, and enforces strong authentication before any mail transfer is allowed. The exposed service should behave like a controlled access point for legitimate users, not a generic SMTP entry path.

Before opening it broadly, confirm that relay rules reject unauthenticated sending, that brute-force protection is in place, and that logs show who authenticated, when, and from where. If you cannot verify those controls, treat exposure as premature. The safest pattern is to expose the port because remote users need it, not because the mail server is easier to operate that way.

Rate limiting and anti-abuse controls are part of the exposure decision, not optional extras. Without them, even valid accounts can be weaponised for large-volume mail generation after compromise. That is why submission endpoints should be governed as high-abuse services, not ordinary application ports.

Risk and Threat Considerations

Exposing Port 587 increases the attack surface for credential attacks and mail abuse, especially when the service is reachable from the public internet and tied to user accounts that can send externally. The risk is not the port itself, but the combination of internet reachability, authentication exposure, and the high business value of mail-sending rights.

Failure mechanism: Attackers probe for weak credentials, exploit reused passwords, or abuse compromised accounts to send spam, phishing, or malicious links through a trusted mail domain. If relay restrictions or rate controls are missing, a single compromised account can generate large outbound volume quickly.

Impact: The organisation can suffer reputation damage, delivery blocking, account takeover fallout, and downstream phishing abuse that appears to come from a legitimate sender. Mail infrastructure may also be throttled or blacklisted, creating operational disruption beyond the initial compromise.

Practitioner Guidance

What to verify: Confirm that the listener is submission-only, requires TLS, and rejects any unauthenticated relay attempt. Then test whether a valid but low-privilege account can send beyond its intended scope, because that is often where abuse controls fail first.

What to measure: Track authentication failures, submission volume per account, destination diversity, and sending bursts outside normal user behaviour. These signals tell you whether the endpoint is functioning as a controlled mail submission service or as an abuse channel.

Practitioner takeaway: Port 587 is acceptable to expose when it is engineered as a tightly controlled, authenticated submission service, but internet reachability without strong auth, TLS, and abuse controls turns it into a predictable spam and compromise target.

Related resources from NHI Mgmt Group

• Is it safe to expose port 25 (SMTP) to the internet?
• Is it safe to expose Port 53 for DNS to the internet?
• Is it safe to expose Port 135 (RPC) to the internet?
• Is it safe to expose port 27017 for MongoDB to the internet?