Apple iCloud SMTP Times Out on Port 465: The 587 STARTTLS-Only Trap
The alert that broke the silence
An automated account health monitor running as a background maintenance task on a Windows administration host dispatched an alert during scheduled telemetry:
Cronjob Response: himalaya account health (job_id: 2f09440986e4)
-------------
📧 himalaya account health check — FAILED
❌ icloud (smtp)
smtp: FAIL (connect smtp.mail.me.com:465: A connection attempt failed
because the connected party did not properly respond after a period of time,
or established connection failed because connected host has failed to respond. (os error 10060 / WSAETIMEDOUT))Reading mail over IMAP (imap.mail.me.com:993) continued to function with sub-second response times. Authentication tokens and app-specific passwords were confirmed valid. Yet every outbound delivery attempt over SMTP stalled for thirty seconds before aborting with a TCP timeout error (WSAETIMEDOUT / OS error 10060).
Implicit TLS versus STARTTLS
The root cause lay in a subtle assumption regarding outbound mail security standards. In the CLI client configuration (~/.config/himalaya/config.toml), the iCloud profile had been configured following the conventional pattern used by Gmail and custom mail servers:
# Initial configuration
[accounts.icloud]
email = "[email protected]"
backend = "imap"
imap.server = "imap.mail.me.com"
imap.port = 993
imap.encryption = "tls"
message.send.backend = "smtp"
smtp.server = "smtps://smtp.mail.me.com:465"Port 465 was originally allocated for SMTPS (implicit TLS, where the TLS handshake happens immediately upon TCP connection establishment). While many commercial mail providers support both port 465 and port 587, Apple’s mail infrastructure (smtp.mail.me.com) strictly enforces legacy RFC 6409 / RFC 3207 submission standards rather than RFC 8314 implicit TLS on port 465:
- Port 465 is completely closed or dropped on Apple edge firewalls. Packets sent to port 465 are silently discarded (leading to
WSAETIMEDOUT/ETIMEDOUTrather than an immediateECONNREFUSED). - Outbound message submission is only accepted on port 587 via cleartext TCP followed by an explicit
STARTTLShandshake.
Attempting an implicit SSL connection (smtps://) to port 465 meant the client waited for a TLS Client Hello response that Apple’s gateway was never configured to send.
The fix: switching to port 587 with starttls
The configuration was adjusted to enforce explicit STARTTLS over port 587:
🔍 config.toml — iCloud SMTP configuration (11 lines)
[accounts.icloud]
email = "[email protected]"
backend = "imap"
imap.server = "imap.mail.me.com"
imap.port = 993
imap.encryption = "tls"
message.send.backend = "smtp"
smtp.server = "smtp://smtp.mail.me.com:587"
smtp.starttls = trueNotice the change from the smtps:// URI scheme to smtp://, combined with smtp.starttls = true.
The result
Testing the connection immediately after the configuration change verified the resolution:
$ himalaya account check --account icloud
Account: icloud
imap: OK
smtp: OKThe health check cron script executed with an exit code of 0. All six configured mail profiles returned green status, and monitoring returned to its normal silent operation.
Looking for high-impact engineering work or custom systems?
From front-end web apps down to edge proxies and container automation. Open to serious freelance client projects and senior engineering roles.
