How to Fix Gmail Port 587 vs. 465 Timeouts

When configuring custom applications, mail clients, network printers, or automated scripts to send outbound email through Gmail, the process can fail with a connection timeout error. Typical error messages include Connection timed out, Operation timed out on port 587, or Could not connect to SMTP host: smtp.gmail.com:465.

Quick Answer

Gmail SMTP timeouts occur when your security protocol does not match your port: port 587 requires explicit TLS via the STARTTLS command, while port 465 requires implicit SSL/TLS from the initial handshake. Align port 587 with STARTTLS or port 465 with SSL/TLS. If timeouts persist, test outbound firewall rules for TCP egress blocking.

---

The Core Technical Difference: Port 587 vs. Port 465

Ports 587 and 465 handle encryption differently at the network layer:

Parameter	Port 587	Port 465
IETF Standard	RFC 6409 (Message Submission)	RFC 8314 (Implicit TLS Submission)
Encryption Type	Explicit TLS (STARTTLS)	Implicit SSL / TLS
Initial Handshake	Plaintext TCP connection first	Immediate TLS handshake upon connection
Network Failure Symptom	Hangs waiting for STARTTLS command	Drops immediately if sent plaintext

• Port 587 (Explicit TLS): The client connects in plain text and exchanges basic greeting headers (EHLO). The client then issues the STARTTLS command, upgrading the open session to an encrypted TLS channel before sending authentication credentials.
• Port 465 (Implicit TLS): The client must establish a TLS tunnel immediately upon establishing the TCP socket. Plaintext commands are rejected, and failing to begin with a cryptographic TLS handshake causes the connection to time out or close immediately.

---

Why Connection Timeouts Occur

Outbound SMTP Timeout
│
├── Did you pair Port 587 with "SSL" or Port 465 with "STARTTLS"?
│   ├── YES ──► Protocol handshake deadlock. Match 587/STARTTLS or 465/SSL.
│   └── NO  ──► Network or firewall restriction.
│
├── Can your system open a raw TCP socket to Google?
│   ├── NO  ──► Local firewall, corporate proxy, or ISP blocking outbound mail ports.
│   └── YES ──► Deep Packet Inspection (DPI) terminating STARTTLS negotiation.

1. Protocol Mismatch Deadlocks

The most common cause of timeouts is configuring port 587 with “SSL” enabled, or port 465 with “SSL” disabled (or set to STARTTLS):

• Sending an implicit SSL handshake to port 587 causes Gmail to wait for plain text, resulting in an idle timeout.
• Sending plaintext EHLO to port 465 causes Gmail to wait for a cryptographic ClientHello, resulting in an immediate socket drop or timeout.

2. ISP and Cloud Provider Egress Filtering

Many residential internet service providers (ISPs) and cloud hosting platforms (such as Amazon Web Services EC2, Google Cloud Platform, and Microsoft Azure) block outbound TCP traffic on port 25 entirely. Some also restrict port 587 to prevent compromised virtual machines from sending spam.

3. Antivirus and Firewall Deep Packet Inspection

Endpoint protection software (like Norton, Bitdefender, or Windows Defender Firewall) and enterprise edge firewalls often inspect outbound SMTP traffic. When a security product intercepts port 587 to examine traffic before it upgrades to STARTTLS, the TLS session negotiation can break, leading to connection timeouts.

---

Step-by-Step Diagnostic & Troubleshooting Path

Step 1: Align Port and Encryption Protocol

In your mail client, .env file, or application configuration, verify that your settings match one of these two valid pairs:

Configuration Option A (Recommended for standard mail clients):

• Server: smtp.gmail.com
• Port: 587
• Encryption: STARTTLS (sometimes labeled as “TLS” or “Auto”)

Configuration Option B (Recommended for legacy apps or restricted environments):

• Server: smtp.gmail.com
• Port: 465
• Encryption: SSL/TLS (sometimes labeled as “Implicit TLS”)

---

Step 2: Test Network Connectivity via CLI

Determine whether the timeout stems from a local network block or an application configuration bug by testing raw TCP connectivity.

On Windows (PowerShell):

Test-NetConnection -ComputerName smtp.gmail.com -Port 587
Test-NetConnection -ComputerName smtp.gmail.com -Port 465

On macOS or Linux (Terminal):

nc -zv smtp.gmail.com 587
nc -zv smtp.gmail.com 465

• If TcpTestSucceeded : True (or succeeded!): The port is open on your network. The timeout is caused by a protocol mismatch or invalid credentials in your application. If authentication fails once the socket connects, consult “535 5.7.8” (Authentication Failed).
• If the test times out: Your router, ISP, or corporate firewall is actively dropping outbound packets on that port.

---

Step 3: Test Interactive Handshakes with OpenSSL

If connectivity succeeds but your app still hangs, verify that the encryption negotiation completes properly using openssl:

To test Port 587 (Explicit STARTTLS):

openssl s_client -connect smtp.gmail.com:587 -starttls smtp -crlf

You should see the SSL certificate chain followed by 250 SMTPUTF8. If this command hangs during the TLS handshake, your network gateway or firewall is terminating STARTTLS packets.

To test Port 465 (Implicit TLS):

openssl s_client -connect smtp.gmail.com:465 -crlf

You should immediately receive the server certificate and an initial 220 smtp.gmail.com ESMTP greeting banner.

If your network blocks direct connections to Gmail’s consumer SMTP endpoints, consider routing your outbound traffic through the Google Workspace relay network. For instructions, see Troubleshooting SMTP Relay: “550 5.7.1 Relaying Denied”.