Ports Reference

Ports Reference

This page began as a chapter of the 6.2.10 manual and has been corrected for 6.2.24, then rewritten against the 6.2.28 source on 8 September 2026. The Control Panel's pages are grouped differently now, so the paths below use today's groups; the TLS ports 465, 993 and 995 exist only after you create them on the TCP/IP ports page (a fresh install seeds 25, 587, 110 and 143); and everything added since 6.2.10 is in Changes-Since-6210. Where a value here disagrees with the Settings Reference, which is generated from the code, the reference is right.

Every socket hMailServer can open, and every socket it can open towards something else. There are two kinds, and they are configured in two different places:

• Mail-protocol listeners — SMTP, POP3 and IMAP. Rows in the database table hm_tcpipports, edited under Connections & protocols → TCP/IP ports. You may create as many as you like, on as many addresses as you like.
• Service listeners — the metrics endpoint, the REST API and self-service portal, the public web services, ManageSieve. Each is a single key in hMailServer.INI, each defaults to off, and each has its own bind address.

1. Everything at a glance

flowchart LR
  subgraph OUT["The internet"]
    MTA["Other mail servers"]
    CLI["Your users' mail clients"]
    ACME["ACME certificate authority"]
    BROW["Browsers, Thunderbird, Outlook"]
  end

  subgraph LOCAL["Localhost / your management network"]
    PROM["Prometheus, health probes"]
    SCRIPT["Administration scripts"]
    SIEVE["Sieve script managers"]
  end

  subgraph HMS["hMailServer"]
    P25["SMTP 25 — inbound mail"]
    P587["SMTP 587 — submission"]
    P465["SMTP 465 — submission, implicit TLS"]
    PIMAP["IMAP 143 / 993"]
    PPOP["POP3 110 / 995"]
    PWEB["Web services — WebServicesHttpPort / WebServicesHttpsPort"]
    PREST["REST API and /portal — RestApiPort"]
    PMET["Metrics — MetricsServerPort"]
    PSIEVE["ManageSieve — ManageSieveServerPort"]
  end

  MTA --> P25
  CLI --> P587
  CLI --> P465
  CLI --> PIMAP
  CLI --> PPOP
  BROW --> PWEB
  BROW --> PREST
  ACME --> PWEB
  PROM --> PMET
  SCRIPT --> PREST
  SIEVE --> PSIEVE

Loading

Only the boxes in the middle are listeners. Everything hMailServer initiates — delivery to other servers, DNS, the virus and spam daemons, the database — is in section 6.

2. The short table

Port	Protocol	Encryption	Who uses it	Open to the internet?
25	SMTP	STARTTLS	Other mail servers delivering to you	Yes — required
587	SMTP submission	STARTTLS	Your users sending mail	Yes
465	SMTPS	Implicit TLS	Your users sending mail (legacy-modern)	Optional
143	IMAP	STARTTLS	Your users reading mail	Optional — prefer 993
993	IMAPS	Implicit TLS	Your users reading mail	Yes
110	POP3	STARTTLS	Your users reading mail	Optional — prefer 995
995	POP3S	Implicit TLS	Your users reading mail	Optional
80	HTTP	None	ACME challenges, autoconfig	Only if using ACME/web services
443	HTTPS	TLS	MTA-STS policy, autoconfig, autodiscover	Only if using MTA-STS hosting
4190	ManageSieve	STARTTLS when the server has a certificate to offer	Users managing Sieve scripts	No — off by default (ManageSieveServerPort=0), localhost only when on
(your choice)	REST API, and the self-service portal at /portal (new in 6.2.28)	TLS (required unless bound to 127.0.0.1/::1)	Administration scripts; users signing in to the portal	No for administration alone — localhost, or TLS + firewall. If users are to reach the portal, a certificate and a reachable bind address
(your choice)	Metrics	None by default; TLS with MetricsServerCertificateFile + MetricsServerPrivateKeyFile	Prometheus, health probes	No — localhost only

Ports are configured under Connections & protocols → TCP/IP ports.

3. Mail-protocol listeners

3.1 What a fresh install creates

A new database is seeded with exactly four rows — all of them without encryption:

Protocol	Port	Connection security	Certificate
SMTP	25	None	—
SMTP	587	None	—
POP3	110	None	—
IMAP	143	None	—

(Source: hmailserver/source/DBScripts/CreateTablesMSSQL.sql, and the MySQL and PostgreSQL equivalents.) Ports 465, 993 and 995 are not created for you: you add them yourself once you have a certificate. Changing the security of 587, 143 and 110 from None to STARTTLS required is the other half of the same job — see Encryption and Certificates.

3.2 The columns behind the dialog

Each row is one hm_tcpipports record. The numbers are persisted and exposed through the COM API, so they never change meaning between versions.

Dialog field	Column	Values
Protocol	portprotocol	1 = SMTP, 3 = POP3, 5 = IMAP
IP address	portaddress1 / portaddress2	0.0.0.0 (or ::) means every address on the machine
TCP port	portnumber	1–65535
Connection security	portconnectionsecurity	0 = None, 1 = SSL/TLS (implicit), 2 = STARTTLS optional, 3 = STARTTLS required
Certificate	portsslcertificateid	The SSL certificate row to present; 0 = none
Client certificates	portclientcertificatepolicy	0 = off, 1 = request, 2 = require

3.3 The four connection-security settings, on the wire

sequenceDiagram
    autonumber
    participant C as Client
    participant S as hMailServer

    rect rgba(80, 140, 255, 0.12)
    Note over C,S: Connection security = SSL/TLS — implicit, the 465/993/995 shape
    C->>S: TCP connect
    C->>S: TLS ClientHello
    S->>C: certificate, handshake
    S->>C: 220 mail.example.com ESMTP
    Note right of S: The banner is sent only after the handshake completes
    end

    rect rgba(80, 200, 120, 0.12)
    Note over C,S: Connection security = STARTTLS optional or required
    C->>S: TCP connect
    S->>C: 220 mail.example.com ESMTP
    C->>S: EHLO client.example.net
    S->>C: 250-STARTTLS ... 250 HELP
    C->>S: STARTTLS
    S->>C: 220 Ready to start TLS
    C->>S: TLS ClientHello
    S->>C: certificate, handshake
    Note right of S: The session resets to the just-greeted state.<br/>The client MUST send EHLO again — RFC 3207 section 4.2
    end

Loading

The reset after STARTTLS is not cosmetic. Everything learned before the handshake is discarded: the HELO host name, any credentials, any transaction in progress. Until 6.2.24 the state machine stayed in the post-greeting state instead, which let a client send MAIL FROM on the encrypted session with an empty HELO host — skipping the HELO host spam test and the OnHELO/OnEHLO script events. (Source: Server/SMTP/SMTPConnection.cpp, OnHandshakeCompleted.)

Setting	What the server does	What a client sees	What happens when it is wrong
None (0)	Plain text. STARTTLS is answered 503 5.5.1 Bad sequence of commands, and it is not advertised.	Everything, including the password, in the clear.	The commonest configuration accident. Add TLS before you publish the port.
SSL/TLS (1)	Handshake first; the banner comes after. No STARTTLS keyword.	Correct for 465, 993, 995.	Set on 587/143/110 by mistake: existing clients hang, then time out — they wait for a banner that will not arrive until they speak TLS.
STARTTLS optional (2)	Advertises STARTTLS. Accepts both encrypted and cleartext sessions.	The right setting for port 25 — a sending server that cannot do TLS must still be able to deliver.	On a submission port it lets a misconfigured client send its password in the clear.
STARTTLS required (3)	Advertises STARTTLS, and answers 530 5.7.0 Must issue STARTTLS first. to every command except NOOP, EHLO, STARTTLS and QUIT.	The right setting for 587, and for 143/110 if you keep them.	On port 25 it silently refuses mail from every server that cannot do TLS. Do not use it there.

Two failure modes are worth naming because the symptom does not point at the cause:

• TLS chosen but no certificate selected. The listener does not start at all. The application log records error HM5113, Error initializing SSL. Certificate not set. with the address and port. Clients get connection refused; nothing appears in the SMTP log, because no session is ever created.
• Port already in use. Error HM4316, Failed to bind to local port… This is often caused by another server listening on the same port. The rest of the server starts normally, so mail on the other ports keeps flowing and only one protocol looks broken.

3.4 Client certificates (mutual TLS), per port

Deliberately a per-port setting: the population connecting to a partner-relay SMTP port and the population on the public IMAP port do not share an issuing CA, and a single global switch would force the strictest policy onto every listener at once.

Policy	Behaviour	If the CA bundle cannot be loaded
Off (0)	No certificate is requested. The default, and what every port did before this setting existed.	—
Request (1)	A certificate is asked for, verified if offered, and the outcome logged — but the handshake never fails over it. Use it to inventory which clients could survive require.	Reported (HM6140) and the port starts anyway.
Require (2)	The handshake fails unless the client presents a certificate chaining to the port's CA bundle.	The listener is not started — "require" with no trust anchors can only reject everybody.

The bundle is the only trust anchor for client certificates on that port — not the Windows certificate store. A verified client certificate is also what makes SASL EXTERNAL appear in the EHLO, CAPABILITY and CAPA responses on that connection.

Setting a client-certificate policy on a port with no TLS is refused when you save it. A hand-edited database that has one anyway is reported as HM6142; require stops the listener, request only logs.

3.5 Per-port options that are not on the port dialog

Setting	Where	Default	What it does
DisableAUTHList	hMailServer.INI, [Settings]	empty	Comma-separated list of local port numbers on which SMTP AUTH is neither advertised nor accepted. Use it to keep authentication off port 25.
SMTPProxyProtocolEnabled / SMTPProxyProtocolTrustedIPs	hMailServer.INI	0 / empty	Accept a HAProxy PROXY header from a listed peer, so the session behaves as if the real client had connected. A PROXY line from an untrusted peer closes the connection without a reply.
SMTPXClientEnabled / SMTPXClientTrustedIPs	hMailServer.INI	0 / empty	The Postfix XCLIENT verb, same purpose. Advertised only to a trusted peer, decided against the real TCP address; anyone else never learns the verb exists.
SMTPDMinTimeout / SMTPDMaxTimeout	hMailServer.INI	10 / 1800 seconds	Idle timeout for an inbound SMTP session, scaled down towards the minimum as load rises.
POP3DMinTimeout / POP3DMaxTimeout	hMailServer.INI	10 / 600 seconds	The same, for POP3.
(IMAP)	not configurable	300 – 1800 seconds	The IMAP idle timeout is fixed in code at 5 to 30 minutes.
SmtpTarpitCount / SmtpTarpitDelaySeconds	hMailServer.INI	0 / 0	After count RCPT TO commands in one unauthenticated session, every further reply — refusals included — is held for delay seconds. Aimed at dictionary attacks; a range exempt from spam protection is exempt from this too.
LogonTarpitSeconds	hMailServer.INI	0	Delay added per failed logon on the same connection, multiplied by the failure count and capped.

RequireTLSForAuth is not a port setting at all — it lives on the IP range (Access & abuse protection → IP ranges, the Require auth tab), and it changes what SMTP EHLO, IMAP CAPABILITY, POP3 CAPA and the ManageSieve capability response advertise to a client from that range. A range that requires TLS is offered no authentication mechanism at all on a cleartext connection, and IMAP additionally advertises LOGINDISABLED, so a client learns before it sends the password rather than after.

4. Service listeners in hMailServer.INI

All keys are in the [Settings] section. Every one of these listeners is off by default, and every one is rebuilt when the service restarts — changing the key alone is not enough.

Feature	Port key	Default	Bind key	Bind default	TLS	Refuses to start when…
Metrics + health probes	MetricsServerPort	0 (off)	MetricsServerBindAddress	127.0.0.1	MetricsServerCertificateFile + MetricsServerPrivateKeyFile; plain HTTP otherwise	—
REST API + /portal	RestApiPort	0 (off)	RestApiBindAddress	127.0.0.1	RestApiCertificateFile + RestApiPrivateKeyFile, falling back to the ACME fullchain.pem/privkey.pem	the administrator password is not set; or no certificate is configured and the bind address is not 127.0.0.1, localhost or ::1
Public web services	WebServicesHttpPort, WebServicesHttpsPort	0, 0 (off)	WebServicesBindAddress	0.0.0.0	WebServicesCertificateFile + WebServicesPrivateKeyFile on the HTTPS port	—
ManageSieve	ManageSieveServerPort	0 (off)	ManageSieveServerBindAddress	127.0.0.1	Reuses the certificate configured on an IMAP, POP3 or SMTP port; STARTTLS is advertised only when one is available	—
ACME http-01 challenge	AcmeHttpPort	80	—	every address	never	—

4.1 Metrics and health

Four paths, on MetricsServerPort:

Path	Answer	Authentication
/livez	200 alive if the process and listener thread are responsive. No dependency checks, so a database outage does not get a healthy process killed by an orchestrator.	Never required
/readyz	200 ready, or 503 not ready: <reason> when the database is not connected	Never required
/healthz	JSON health document, 200 or 503	Never required
/metrics	Prometheus text exposition	MetricsServerAuthToken, or MetricsServerAuthUsername + MetricsServerAuthPassword, when set

The three probes are answered before anything that could refuse: a probe has nowhere to keep a credential. Unauthorised /metrics requests are counted (hmailserver_metrics_unauthorized_requests_total) rather than logged, so a scanner cannot fill the application log.

Leave the bind address at 127.0.0.1 unless you have set a credential and a certificate. See Monitoring and Health.

4.2 REST API and the self-service portal

One listener serves both. It will not start without an administrator password, and it will not start in the clear on anything but loopback. Its TLS uses the same cipher list, protocol versions, option mask and key-exchange groups as the mail protocols — including the post-quantum groups from TlsKeyExchangeGroups — rather than OpenSSL's defaults.

If RestApiCertificateFile is empty and ACME has produced fullchain.pem and privkey.pem, those are used and the choice is written to the application log: RestApi: Using the ACME certificate for HTTPS. The startup line names the outcome either way: RestApi: Listening on <endpoint> (https) or (http, loopback only).

The portal at /portal is the page your users sign in to; the /api/v1/… routes are for administration. If users are to reach the portal, this listener needs a real certificate and a reachable bind address — which also means it needs a firewall rule and, sensibly, a name of its own in DNS. See The REST API and APIs Reference.

4.3 Public web services

Everything a browser or a mail client fetches over HTTP:

Path	Purpose	Needs
/.well-known/mta-sts.txt	The MTA-STS policy, built from MtaStsPolicyMode, MtaStsPolicyMaxAge and MtaStsPolicyMx	HTTPS only, per RFC 8461 §3.3
/.well-known/acme-challenge/<token>	ACME http-01 challenge responses	HTTP
/mail/config-v1.1.xml, /.well-known/autoconfig/mail/config-v1.1.xml	Thunderbird autoconfig	AutoconfigEnabled (default 1)
/autodiscover/autodiscover.xml	Outlook autodiscover (POX). Outlook POSTs; GET is accepted too	AutoconfigEnabled
/email.mobileconfig, /mail/config.mobileconfig	Apple configuration profile	AutoconfigEnabled
/.well-known/security.txt, /security.txt	Contact details, for hosted domains with a postmaster address	—
/.well-known/caldav, /.well-known/carddav	RFC 6764 service-discovery redirects	A redirect target configured

Both port keys default to 0, while MtaStsHostingEnabled and AutoconfigEnabled default to 1. That combination — features on, nothing listening — is the shipped default, and it is reported once at startup so you are not left wondering why the URLs are silent. The port defaults are left alone deliberately: binding port 80 on a box that may be running IIS would be a worse failure.

4.4 ManageSieve

Off by default and bound to loopback when on. It has no certificate of its own: STARTTLS is offered only if an IMAP, POP3 or SMTP port has one, and if none does, the log says so — ManageSieveServer: No TLS certificate is configured on an IMAP, POP3 or SMTP port, so STARTTLS will not be offered. Bind the listener to 127.0.0.1, or put it behind a TLS terminator.

Its capability response is IMPLEMENTATION, SIEVE, STARTTLS (when usable), SASL, UNAUTHENTICATE and VERSION "1.0". When the connecting range requires TLS and the session is still in the clear, the SASL line is advertised empty rather than offering PLAIN — the client upgrades, the capability response is re-issued, and only then is a password sent. See Rules and Sieve.

4.5 The ACME challenge listener

AcmeHttpPort defaults to 80, and this is the one entry in the table that is not a permanent listener. During each certificate issuance:

flowchart TD
  A["Renewal due"] --> B{"Is WebServicesHttpPort<br/>the same as AcmeHttpPort?"}
  B -- yes --> C["The always-on web services listener<br/>serves /.well-known/acme-challenge/"]
  B -- no --> D["A temporary listener is bound on AcmeHttpPort<br/>for the duration of the issuance"]
  D --> E{"Bind succeeded?"}
  E -- no --> F["ACME: Failed to start the http-01 challenge listener.<br/>Is the port in use?"]
  E -- yes --> C
  C --> G["CA fetches the token over HTTP<br/>and issues the certificate"]

Loading

If ACME is enabled and the two ports differ, that is said once at startup so a port conflict weeks later during a renewal is not a surprise. See Encryption and Certificates.

5. What each listener says when you connect to it

Useful for proving that the thing answering a port is the thing you think it is.

SMTP — the banner is the Welcome banner from Connections & protocols → Protocols → SMTP, or the computer name if that is blank, with ESMTP appended:

220 MAIL01 ESMTP
EHLO test.example.net
250-MAIL01
250-SIZE 20971520
250-8BITMIME
250-PIPELINING
250-CHUNKING
250-BINARYMIME
250-SMTPUTF8
250-ENHANCEDSTATUSCODES
250-DSN
250-STARTTLS
250-AUTH LOGIN SCRAM-SHA-256
250 HELP

SIZE is the maximum message size in KB × 1024 — the default 20480 KB gives 20971520. A bare 250-SIZE means the limit is set to 0, i.e. unlimited. STARTTLS appears only on a STARTTLS port that is not yet encrypted. The AUTH line grows SCRAM-SHA-256-PLUS on a TLS connection, XOAUTH2 OAUTHBEARER when OAuth2 is enabled, and EXTERNAL when the handshake verified a client certificate; PLAIN appears only when plain-text authentication is allowed. XCLIENT ADDR NAME PORT PROTO HELO LOGIN appears only to a trusted upstream.

IMAP — * OK IMAPrev1, or your welcome message. POP3 — +OK POP3, or your welcome message.

Monitoring & troubleshooting → Server status lists the listeners the service actually brought up, which is the fastest way to tell a firewall problem from a configuration one:

If the port is implicit TLS you will get no banner at all until you speak TLS:

# Prove a port is listening and which process owns it
Get-NetTCPConnection -State Listen -LocalPort 587 |
  Select-Object LocalAddress, LocalPort, OwningProcess

# Read the banner and the EHLO keywords over implicit TLS
openssl s_client -connect mail.example.com:465 -quiet

6. Outbound connections the server makes

None of these is a listener, and none of them appears on the TCP/IP ports page. They are what your outbound firewall rules have to allow.

Destination	Port	Configured by	What breaks if it is blocked
Every recipient domain's MX host	25	Nothing — this is how SMTP works	Nothing leaves the server. Messages accumulate in the delivery queue and are retried, by default 4 times at 60-minute intervals, then bounced. Many consumer ISPs block outbound 25; a smart host is the usual answer.
Smart host / SMTP relayer	smtprelayerport, default 25	Mail flow & delivery → Delivery of e-mail, the SMTP relayer (smart host) card	Same symptom, one hop earlier. The relayer's own connection security and credentials are set beside the port.
A route's target host	routetargetsmtport per route	Mail flow & delivery → Routes	Only the domains that route through it are affected. See Routes and Relays.
DNS resolvers	53 UDP and TCP	The machine's own resolvers, or the custom server list under Connections & protocols → DNS resolver	MX lookups fail, so nothing is delivered externally; DNSBL, SPF, DKIM, DMARC, MTA-STS and DANE all stop working at once. Custom server entries must be given port 0 — the Windows DNS client supplies port 53 itself and rejects an entry that specifies one.
SpamAssassin spamd	spamassassinport, seeded 783	Spam & virus filtering → Anti-spam settings	Messages are still delivered; the SpamAssassin test contributes no score. A slow spamd shows up as a long "Spam test: SpamAssassin" time in the log.
ClamAV clamd	ClamAV host and port, with no seeded default	Spam & virus filtering → Anti-virus settings	Depends on AVFailAction: messages are either delivered unscanned or held. clamd is PINGed before it is trusted.
Database server	[Database] Port, default 0 = the provider's own default	The installer, or hMailServer.INI	The server marks the database unavailable and answers 451 4.3.2 rather than losing mail. See Migrating the Database Backend.
ACME directory	443	AcmeDirectoryUrl	Certificates are not issued or renewed.
MTA-STS policy fetch (of other domains)	443	MtaStsEnabled, default 1	Delivery to domains publishing an enforcing policy falls back to whatever DANE and your TLS settings allow.
OTLP collector	as configured	OtelEndpoint, OtelMetricsEndpoint, OtelLogsEndpoint	Traces, metrics and logs are not exported; mail is unaffected.
Forward proxy	as configured	HttpProxy (new in 6.2.28)	When set, every request the server makes as a web client goes through it — CONNECT for HTTPS, an absolute URL for plain HTTP.

DANE and TLS-RPT need no port of their own: DANE is DNS (TLSA records over the resolver above), and TLS-RPT reports are sent as ordinary mail.

7. Firewall matrix

Rule	Direction	Ports	Why
Allow from anywhere	inbound	25	Mandatory. Any server on the internet must be able to offer you mail.
Allow from anywhere	inbound	587, 465, 993, 995	Only the ones you actually created. Prefer the implicit-TLS pair.
Allow from anywhere	inbound	80, 443	Only if you use ACME, MTA-STS hosting or autoconfiguration.
Allow from your management network	inbound	REST API / metrics / ManageSieve ports	Or leave them on 127.0.0.1 and reach them over a tunnel.
Allow to anywhere	outbound	25	Delivery. Or to your smart host only.
Allow to your resolvers	outbound	53	Everything depends on it.
Deny	inbound	143, 110	Once you have 993 and 995, and once no client is left on the old ports.

8. Symptoms and causes

Symptom	Likely cause	Where to look
No mail arrives; senders report timeouts; nothing at all in the SMTP log	Port 25 blocked upstream, or no listener bound	The listener never accepted a connection, so there is nothing to log. Check the firewall, then Monitoring & troubleshooting → Server status for the listener list
One protocol dead, the rest fine	Bind failure on that port	Application log, error HM4316
A TLS port refuses connections after a certificate change	Certificate row missing or unreadable	Application log, error HM5113; TLS & certificates → SSL certificates
Clients hang on connect and then time out	Implicit TLS set on a STARTTLS port (or the reverse)	The port's connection-security value
Clients can read mail but not send	No submission port, or AUTH disabled on the port they use	DisableAUTHList; the port's protocol and security
530 Must issue STARTTLS first	The port is STARTTLS required and the client has not upgraded	Correct — fix the client, or the range's RequireTLSForAuth
530 5.7.0 SMTP authentication is required	The client is relaying without authenticating	Access & abuse protection → IP ranges, the four relay permissions
Everything works from the LAN, nothing from outside	The listener is bound to a single internal address	The port's IP address; use 0.0.0.0 for every address
MTA-STS or autoconfig URLs return nothing	WebServicesHttpPort and WebServicesHttpsPort are still 0	The startup report in the application log names this exact case
/portal unreachable from a user's browser	RestApiBindAddress is 127.0.0.1, or no certificate is configured	The RestApi: Listening on … line at startup

---