465

Port 465/tcp has one of the most tangled histories in the IANA registry, and getting it right is a differentiator versus copycat port sites that still call it "deprecated SMTPS." The port was first registered around 1997 as smtps (SMTP over SSL), then revoked — RFC 8314 notes the original registration "made no sense" because MX-routed SMTP has no way to negotiate a port — and the slot was reassigned to an unrelated multicast service (urd, URL Rendezvous Directory for SSM). In January 2018, RFC 8314 re-designated 465 for "message submission over implicit TLS" under the service name submissions. The result is a genuine dual registration: the live IANA registry today lists both urd and submissions on TCP 465 (and igmpv3lite on UDP 465). For email, 465 is functionally equivalent to the 587 submission port but uses implicit TLS — the TLS handshake begins immediately on connect, before any SMTP exchange — which removes the cleartext negotiation window and saves a round-trip. The MSA must implement SMTP AUTH (RFC 4954) and the requirements of RFC 6409/RFC 5068. Because TLS is established up front, 465 is immune to the STARTTLS-stripping/command-injection attack class that affects 25/587; it remains subject to credential brute-force/password-spray if weak authentication is allowed, and RFC 8314 requires TLS 1.2+ with certificate hostname validation. For an analyst, an open 465/tcp indicates a mail submission agent offering implicit-TLS submission; verify certificate validity and hostname, confirm TLS ≥1.2, and check that AUTH is enforced. The correct present-tense statement is that 465 is an IANA-registered, RFC-endorsed implicit-TLS submission port — not deprecated.

IANA assignment

submissions — "Message Submission over TLS protocol"; reference [RFC8314]; assignee IESG/IETF Chair; registered 2017-12-12. Dual registration: TCP 465 also carries the older urd ("URL Rendezvous Directory for SSM", contact Toerless Eckert, no reference); UDP 465 is igmpv3lite

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 0.013888 (listed under the legacy name "smtps") [Well-established] — nmap-services file

Related ports

587 (submission + STARTTLS), 25 (relay); parallels 993/995 as the implicit-TLS variant

Primary use

SMTP message submission over implicit TLS (handshake on connect, then authenticated RFC 6409 submission)

Other/unofficial uses

legacy "SMTPS" (no-auth) treatment is an anti-pattern; the co-registered urd multicast-directory service

Security implications

implicit TLS eliminates STARTTLS stripping/injection; still subject to credential brute-force/password-spray; RFC 8314 mandates TLS 1.2+ and certificate hostname validation

Typically seen on

provider/host mail submission agents (Gmail/Google Workspace, Microsoft 365, Fastmail all support it)

Analyst note

Open 465/tcp indicates a mail submission agent offering implicit-TLS submission. Confirm certificate validity/hostname, require TLS 1.2+, and verify AUTH is enforced.

Port 465/udp is registered with IANA as igmpv3lite, described as "IGMP over UDP for SSM," and assigned to Toerless Eckert (then at Cisco), with a blank Reference field. IGMPv3lite is a Cisco-developed mechanism that encapsulates IGMPv3 membership-report messages inside UDP datagrams sent to port 465 on the last-hop router, letting hosts whose operating system lacks native IGMPv3 still join Source-Specific Multicast (SSM) groups; Cisco distributed a userspace library and daemon that present an IGMPv3 API and emit these UDP-encapsulated joins/leaves, while Cisco IOS / IOS XE routers consume them on the inbound interface. The reason this UDP assignment confuses analysts is that port 465 is far better known on TCP, where it carries two unrelated services: urd (URL Rendezvous Directory, another Cisco SSM helper that Cisco had IANA reserve so nothing else would occupy the number) and the modern submissions service — Message Submission over implicit TLS, defined in RFC 8314 and registered 2017-12-12 — which is the widely used SMTP-over-TLS email port. Neither TCP entry is a dual-protocol registration of igmpv3lite; the UDP entry stands alone. For an analyst this distinction matters because essentially all internet scanning interest in "port 465" targets the TCP submissions/SMTP surface, not the UDP service. IGMPv3lite traffic is local-network-scoped — last-hop router to host within the same LAN segment — so it does not traverse the public internet in normal operation, public-internet exposure on 465/udp is negligible, IANA marks the port green, and no CVEs or public exploits specific to the UDP igmpv3lite service are documented. A responsive 465/udp is therefore an artifact of a controlled Cisco SSM multicast deployment rather than a normal internet-facing service.

IANA assignment

igmpv3lite — "IGMP over UDP for SSM"; reference (blank — no RFC cited in IANA registry); assignee Toerless Eckert; UDP entry stands alone (not a TCP dual-registration) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (search=465); the IANA Service Name and Transport Protocol Port Number Registry line 950

Range class

well-known (0–1023) [Confirmed] — port number 465

Related ports

465/tcp (urd, submissions/RFC 8314); SSM/multicast control plane (IGMPv3)

Primary use

IGMPv3lite — IGMPv3 membership reports encapsulated in UDP to the last-hop router, so hosts lacking native IGMPv3 can join SSM groups (Cisco mechanism)

Common software

Cisco IOS / IOS XE routers with IGMPv3lite on the last-hop interface; Cisco-distributed userspace IGMPv3 library/daemon on the host. No widely documented third-party implementations

Exposure / scanning

SANS ISC scanning activity for port 465 is attributed to the TCP submissions (SMTP-over-TLS) surface — ~20 distinct scanning IPs/day, largely cloud ranges (AWS, Linode), consistent with SMTP enumeration/credential-stuffing; no meaningful public scanning data exists for 465/udp because IGMPv3lite is LAN-scoped

Security implications

low for 465/udp specifically — LAN-scoped, negligible public-internet exposure, IANA threat level green; no known CVEs, exploits, or C2 campaigns against the UDP igmpv3lite service. Security attention on "port 465" in practice targets the TCP/SMTP-TLS service

Typically seen on

controlled Cisco SSM multicast deployments (campus/enterprise LAN); otherwise an anomaly

TCP-vs-UDP distinction

465/tcp carries urd (URL Rendezvous Directory, Cisco SSM helper, assignee Toerless Eckert) and submissions (Message Submission over TLS, RFC 8314, registered 2017-12-12); neither is a dual-registration of the UDP igmpv3lite entry [Confirmed] — IANA registry (search=465)

Analyst note

A responsive 465/udp is an artifact of a Cisco IGMPv3lite SSM deployment, not internet-facing. Do not conflate it with the SMTP-over-TLS submissions service on 465/tcp, which is where almost all scanning interest in this number lands.