Nearly 11 Million Submission Endpoints on Port 587: The Mail Path That Is Rarely Reviewed

In an interconnected digital ecosystem where cyber threats continuously evolve, researchers and security analysts must periodically examine foundational infrastructure that often remains hidden in plain sight. A comprehensive analysis conducted using the ZoomEye cyberspace search engine on September 26, 2026, revealed a staggering number of exposed mail submission points globally. Specifically, a combined query targeting port 587 and the associated SMTP service fingerprint successfully identified 10,990,138 distinct records. While port 587 is an indispensable pillar of modern internet communication—serving as the designated pathway for authenticated outbound email submission—its massive exposure across the public internet highlights a frequently neglected attack surface.

This vast footprint underscores critical vulnerabilities in how organizations manage email authentication, legacy server configurations, and endpoint security. To understand the gravity of these findings, security professionals must delve into the historical context of email architecture, the technical specifications governing message submission, and the severe implications these exposed endpoints pose for corporate networks and global cybersecurity defenses.

Historical Context and the Architecture of Port 587

To appreciate why nearly 11 million submission endpoints warrant urgent security reviews, one must understand the evolution of email delivery protocols. In the early days of the internet, port 25 was universally utilized for both inbound mail transfer between servers (Mail Transfer Agent to Mail Transfer Agent, or MTA-to-MTA) and outbound mail submission from client applications to servers (Mail User Agent to Mail Transfer Agent, or MUA-to-MTA).

However, as the internet grew and spam became an escalating crisis, network administrators and internet service providers (ISPs) began blocking or heavily throttling outbound traffic on port 25 to prevent compromised residential computers from directly spamming the globe. To accommodate legitimate users who needed to send mail while traveling or connecting from external networks, the Internet Engineering Task Force (IETF) formally defined a dedicated pathway in RFC 6409. This standard established port 587 specifically for message submission.

Unlike port 25, which traditionally operated without mandatory authentication during server-to-server relays, port 587 was explicitly designed with a strict mandate: clients must authenticate themselves before the server accepts any outbound mail for onward delivery. This foundational requirement is the primary reason the port exists. However, over decades of digital expansion, organizations have frequently deployed mail servers, cloud relays, and hybrid infrastructure without auditing whether these submission portals are unnecessarily exposed to the wider public internet.

Breakdown of the ZoomEye Findings and Technical Realities

The identification of nearly 11 million submission endpoints on September 26, 2026, provides a rare, quantitative snapshot of global email infrastructure exposure. Sourced via a single autonomous query against the ZoomEye indexing platform, the data exposes the sheer scale of publicly accessible SMTP submission services.

Cybersecurity experts emphasize that an exposure count of nearly 11 million does not equate to ten million open relays—misconfigured servers that allow unauthenticated users to send spam to arbitrary destinations. Modern mail servers generally enforce authentication on port 587, rejecting unauthenticated connection attempts. Nevertheless, the data reveals that a massive volume of endpoints willingly accept incoming TCP connections from any IP address on the public internet, relying entirely on their internal authentication controls to block unauthorized access.

This reliance introduces two distinct layers of risk: credential exposure and policy enforcement gaps.

First, submission credentials are not confined to heavily fortified data center environments. They are routinely embedded in mail client configurations on laptops, desktop computers, smartphones, and third-party applications utilized by employees worldwide. Because these user endpoints are frequently subjected to malware, phishing campaigns, and endpoint compromises, the credentials granting access to port 587 are inherently vulnerable. If a malicious actor captures valid submission credentials from a single corporate laptop, they gain the ability to authenticate against the exposed port 587 endpoint.

Crucially, because the compromised credentials belong to a legitimate user, the resulting outbound traffic often bypasses standard heuristic spam filters, allowing attackers to leverage the organization’s own domain reputation to distribute phishing emails, malware payloads, or fraudulent financial communications. This creates a severe corporate reputation crisis long before internal security teams detect the unauthorized activity.

Second, policy enforcement mechanisms on legacy submission endpoints often fail to align with modern security expectations. Many organizations operate submission services that predate current cloud platforms, unified security orchestration tools, or Zero Trust architectures. Consequently, these services frequently apply basic authentication checks while omitting essential modern safeguards, such as strict per-account sending velocity limits, geographic access restrictions, anomalous behavior detection, or comprehensive logging and auditing trails. When legacy submission services and modern enterprise security platforms diverge, blind spots emerge that sophisticated threat actors are well-equipped to exploit.

Industry Reactions and Expert Analysis

Following the release of the ZoomEye data, cybersecurity analysts, email infrastructure engineers, and enterprise security leaders have voiced mounting concern over the lack of routine auditing applied to mail submission paths. While security teams routinely scrutinize web applications (ports 80 and 443), secure shell access (port 22), and database listeners, administrative oversight of mail submission ports frequently falls into a bureaucratic grey area—perceived as the exclusive domain of IT helpdesks or email system administrators rather than core network defenders.

Industry experts stress that treating email submission paths as "set-and-forget" infrastructure is no longer viable in the current threat landscape. In interviews regarding the September 2026 findings, network security specialists noted that threat actors increasingly target legacy authentication portals precisely because they bypass the rigorous multi-factor authentication (MFA) mandates now standard for web-based enterprise applications. While organizations have rushed to secure Microsoft 365, Google Workspace, and internal VPN portals with robust MFA, foundational SMTP submission protocols often continue to rely on legacy username and password combinations.

Furthermore, compliance officers and risk management professionals point out that unmonitored submission endpoints complicate adherence to evolving global cybersecurity regulations. Frameworks such as the European Union’s Network and Information Security (NIS2) Directive and various national cybersecurity guidelines increasingly mandate strict asset inventory, continuous exposure management, and comprehensive logging of all external network boundaries. An unreviewed pool of nearly 11 million submission endpoints represents a systemic compliance liability that organizations can no longer afford to ignore.

Actionable Defense Strategies and Mitigation Steps

Mitigating the risks associated with exposed port 587 endpoints requires a deliberate shift from passive acceptance to proactive, defense-in-depth posture management. Security defenders and system administrators are advised to execute a structured remediation roadmap:

1. Comprehensive Asset Discovery and Inventory: Security teams must conduct internal and external network scans to identify every instance where port 587 is active and accessible. Understanding the exact footprint of mail submission services across corporate networks and cloud environments is the essential first step toward risk reduction.

2. Network Segmentation and Perimeter Restriction: Not every mail client requires direct access to enterprise submission servers via the public internet. Organizations should evaluate whether public exposure is strictly necessary. Where feasible, administrative boundaries should be enforced by restricting port 587 access to trusted IP ranges, corporate VPNs, or internal private networks, thereby shielding the service from indiscriminate scanning and brute-force attacks by external malicious actors.

3. Modernize Authentication and Enforce MFA: Legacy username and password authentication on submission ports must be phased out wherever possible. Organizations should integrate modern authentication frameworks, support OAuth 2.0 for mail submission, and enforce multi-factor authentication across all mail user agents to ensure that compromised device credentials alone cannot grant access to the mail path.

4. Implement Rigorous Rate Limiting and Monitoring: Mail administrators must configure aggressive per-account and per-IP sending velocity limits on submission endpoints. Unusual outbound traffic volumes, strange geographic sending locations, or anomalous message formats should trigger automated alerts, enabling Security Operations Centers (SOCs) to intercept compromised accounts before domain reputation damage occurs.

5. Establish Routine Auditing Schedules: Security governance frameworks must incorporate mail submission paths into regular vulnerability assessments and penetration testing exercises. Treating port 587 as a critical security boundary ensures that configuration drift, outdated software libraries, and forgotten legacy relays are systematically identified and remediated.

Conclusion

The discovery of nearly 11 million submission endpoints on port 587 serves as a stark reminder of the complexities inherent in modern digital infrastructure. While the protocol fulfills a vital operational need by facilitating authenticated outbound email delivery, its widespread and largely unreviewed exposure across the public internet introduces profound security risks. From credential harvesting and corporate reputation degradation to the exploitation of legacy policy enforcement gaps, the implications demand immediate attention from defenders worldwide. By adopting rigorous asset discovery, network segmentation, modern authentication controls, and continuous monitoring, organizations can secure this overlooked mail path and fortify their defenses against the evolving threats of tomorrow.