What port should I use for SMTP configuration?

Use port 587 with STARTTLS for client email submission. Port 587 requires authentication before sending, preventing unauthorized relay. Port 25 should only be used for server-to-server relay, and port 465 is for implicit TLS (SMTPS).

What TLS version should my SMTP server support?

Enforce TLS 1.2 or higher (TLS 1.3 preferred). Disable SSLv3, TLS 1.0, and TLS 1.1 as they have known vulnerabilities. Configure strong cipher suites and reject downgrade attempts to protect email in transit.

How do SPF, DKIM, and DMARC work together for SMTP?

SPF validates that sending IPs are authorized for your domain, DKIM adds a cryptographic signature to verify message integrity, and DMARC defines the policy for handling messages that fail SPF or DKIM checks. All three must pass with domain alignment for optimal deliverability.

What are the recommended SMTP timeout settings?

Recommended SMTP timeouts are: connection timeout of 30 seconds, command timeout of 60 seconds, and data timeout of 120 seconds. These values balance reliability (not dropping legitimate slow connections) with resource efficiency (not holding stuck connections indefinitely).

Why should transactional and marketing emails use separate SMTP configurations?

Transactional and marketing emails should use separate IPs and configurations because marketing campaigns carry higher complaint and bounce risks. If a marketing send damages your IP reputation, it won't affect critical transactional emails like password resets and order confirmations that share the same infrastructure.

SMTP Configuration Best Practices

Your SMTP configuration is the invisible backbone of every email you send.

Get it right, and your messages land in inboxes reliably. Get it wrong, and you’re fighting deliverability issues, security vulnerabilities, and performance bottlenecks you may never trace back to the source.

Here are the SMTP configuration best practices that separate professional email infrastructure from amateur setups:

🔒 Security First

Enforce TLS 1.2 or higher. Plaintext SMTP is a liability. Every connection should be encrypted in transit. Configure your server to reject downgrade attempts and disable deprecated protocols (SSLv3, TLS 1.0, TLS 1.1).

Use port 587 with STARTTLS for submission. Port 25 is for server-to-server relay — not for client submission. Port 587 requires authentication before sending, which prevents unauthorized relay abuse.

Implement strong authentication. SASL with OAuth 2.0 or application-specific passwords is the standard. Never store credentials in plaintext configuration files. Use environment variables or secrets management tools.

✅ Authentication and Reputation

Align SPF, DKIM, and DMARC. This isn’t optional anymore. SPF validates your sending IPs, DKIM signs your messages cryptographically, and DMARC tells receivers what to do when checks fail. All three must pass with alignment to your From domain.

Use dedicated IPs for each mail stream. Transactional emails (password resets, order confirmations) and marketing emails should never share the same IP. One bad campaign shouldn’t poison your critical transactional delivery.

⚡ Performance and Reliability

Configure connection pooling. Opening a new TCP+TLS handshake for every message is expensive. Maintain persistent connections to high-volume destinations and reuse them across multiple messages.

Set appropriate timeouts. Connection timeout: 30 seconds. Command timeout: 60 seconds. Data timeout: 120 seconds. Too short and you’ll drop legitimate slow receivers. Too long and stuck connections consume resources.

Implement exponential backoff for retries. When delivery fails temporarily (4xx response), retry at increasing intervals — 1 minute, 5 minutes, 30 minutes, 2 hours. Most temporary failures resolve within the first retry window.

📊 Monitoring and Observability

Log everything. Every connection attempt, authentication result, delivery response, and bounce should be logged with timestamps and message IDs. When deliverability drops, your logs are the first place you’ll look.

Monitor your queue depth. A growing queue means something is wrong — either a destination is down, you’re being rate-limited, or your server is under-provisioned. Set alerts for queue size thresholds.

The Bottom Line

SMTP configuration isn’t a “set it and forget it” task. The threat landscape evolves, receiver policies change, and your sending patterns grow. Review your configuration quarterly. Test your authentication alignment monthly. Monitor your delivery metrics daily.

The organizations that treat SMTP configuration as a core competency — not an afterthought — are the ones that consistently reach the inbox.

What’s the most impactful SMTP configuration change you’ve made? Drop it in the comments. 👇

Author

Harry Shuford

Harry Shuford is an IT specialist and technical writer with a focus on email delivery, deliverability, and the systems that power modern digital communication. With a strong understanding of the technical factors that influence email performance, he writes blog content that helps businesses better understand inbox placement, infrastructure, and best practices for reliable email delivery.