I have recently been developing a C# client which sends emails via a SMTP server. However I have been as to what the different terms ment, like: STARTTLS/TLS/SSL... I had a faint idea of what they ment out of context, but email wise i had no clue.
Upon further investigating I found that SMTP clients communicate with servers in 2 different ways (2 encrypted ways); Explicit SSL/TLS & Implicit SSL/TLS.
From what I understand Explicit SSL/TLS is how STARTTLS works, it asks the server on an unsecured connection if TLS is supported and if it is, it continues with an encrypted connection. Implicit TLS however is secure from the begining of the connection to the end, it is never unsecure.
I might be wrong about this, please correct me if I am.
The question is why is port 587 (Explicit SSL/TLS) the preferred port over port 465 (Implicit SSL/TLS).
I know that port 465 is deprecated and I can see the usefulness of port 587 that it works both encrypted and unencrypted and its up to the client to find out what the server supports.
But I rarely see security updates which is in favor of ease of use, which is why i am confused. Why did we go from fully secure to secure only some of the way?
I hope my question makes sense.