PHP mail connection error
Do not use ssl:// with SMTP port 587: use STARTTLS, or use implicit TLS on port 465
The address ssl://smtp.gmail.com:587 mixes two different connection methods. Port 587 normally begins as a plain SMTP connection and upgrades with STARTTLS. Port 465 starts inside TLS. Use a maintained mail library rather than hand-building the SMTP conversation with fsockopen.
Match the port to its encryption method
| Port | Connection | Application setting |
|---|---|---|
| 587 | Connect first, then issue STARTTLS | TLS or STARTTLS |
| 465 | TLS begins immediately | SSL/TLS or implicit TLS |
Diagnose a connection timeout in order
- 1Fix the scheme and port
Remove ssl:// from port 587 and configure STARTTLS through the mail library.
- 2Check DNS resolution
Confirm the application server resolves the exact SMTP hostname to current addresses.
- 3Test outbound connectivity
Verify the hosting environment permits the intended destination and port without weakening the firewall globally.
- 4Review the provider response
If a connection succeeds, distinguish authentication, TLS verification and sending-policy errors from a network timeout.
Use a maintained SMTP library
It implements STARTTLS correctly
A mail library handles the initial SMTP greeting, capability check, TLS upgrade and authenticated session.
It validates certificates
Keep verification enabled and use the provider’s correct hostname instead of suppressing a mismatch.
It reports useful errors
Structured exceptions help separate DNS, connection, authentication and message-rejection problems.
It is maintainable
Update the dependency and configuration rather than maintaining a custom SMTP protocol implementation.
SMTP timeout questions
Why does ssl:// work with 465 but not 587?
Port 465 begins inside TLS. Port 587 normally requires a regular connection followed by the STARTTLS command.
Should I disable certificate verification?
No. Correct the hostname, trust store or server certificate. Disabling verification hides an important security failure.
Could the provider be blocking the connection?
Yes, but fix the protocol mismatch first. Then test DNS and outbound connectivity from the actual application environment.
Protocol first, network second
Pair port 587 with STARTTLS or port 465 with implicit TLS
If the corrected configuration still times out, provide support with the source service, destination hostname, port, time and exact error.