Problem

What ports does MS Exchange use?
Which TCP/UDP ports are used by Microsoft Exchange?

Solution

When setting up Microsoft Exchange, especially in enterprise environments, correctly configuring firewall rules and network traffic flow is critical. One of the most essential aspects of this setup is understanding which TCP and UDP ports Exchange Server uses, and for what purposes. Without this knowledge, mail flow, client access, synchronization, and many core services may fail to function properly or may become vulnerable to external threats.

This knowledgebase articles details the TCP and UDP ports used by MS Exchange 2003, 2007, 2010, 2013, 2016 and 2019, including their respective roles in the communication stack..

Microsoft Exchange Server is a Windows Server based Mail Server and calendaring platform widely used in enterprise environments. It includes several key components:

• Mailbox Server: Stores emails, calendars, contacts, and performs data retrieval.
  
  
• Client Access Services: Handles all client connections (Outlook, mobile, webmail).
  
  
• Transport Services: Responsible for mail routing and SMTP processing.
  
  
• Edge Transport Role (optional): Secures and routes email at the network perimeter.
  
  

Access to Exchange is typically provided through Microsoft Outlook, Outlook Web Access (OWA), mobile devices using ActiveSync, or through standards-based clients using IMAP and POP3. The protocol and port usage may vary depending on the version of Exchange and whether SSL/TLS is enabled.

Detailed List of Ports Used by Microsoft Exchange

The following table outlines the various ports Exchange uses for different services, categorised by protocol and function:

Protocol	Packet Type	Port	Description
LDAP	TCP	389	Standard LDAP (Lightweight Directory Access Protocol), used by Active Directory, Active Directory Connector, and the Microsoft Exchange Server 5.5 directory. Used for directory lookups and replication. Essential for Exchange to query user/mailbox information.
	TCP	379	The Site Replication Service (SRS) uses TCP port 379. Used for replicating data in mixed environments with Exchange
	TCP	390	While not a standard LDAP port, TCP port 390 is the recommended alternate port to configure the Exchange Server 5.5 LDAP protocol when Exchange Server 5.5 is running on a Microsoft Windows Active Directory domain controller.
	TCP	3268	Global catalog. The Windows Active Directory global catalog (which is really a domain controller "role") listens on TCP port 3268. The Global Catalog allows querying across multiple domains within the forest and is crucial for Outlook address book lookups. When you are troubleshooting issues that may be related to a global catalog, connect to port 3268 in LDAP.
LDAP/SSL	TCP	636	LDAP over Secure Sockets Layer (SSL). When SSL is enabled, LDAP data that is transmitted and received is encrypted.  Typically required for secure directory access in compliance-oriented environments.
	TCP	3269	Global catalog over SSL. Applications that connect to TCP port 3269 of a global catalog server can transmit and receive SSL encrypted data. To configure a global catalog to support SSL, you must install a Computer certificate on the global catalog.
IMAP	TCP	143	Internet Message Access Protocol (IMAP), may be used by "standards-based" clients such as Microsoft Outlook Express, Live Mail, Mobile Devices to access the e-mail server. On early versions of Exchange IMAP4 ran on top of the Microsoft Internet Information Service (IIS) Admin Service and enables client access to the Exchange Information Store. On more recent versions of Exchange IMAP4 runs as two services (Microsoft Exchange IMAP and Microsoft Exchange IMAP Backend).
IMAP/SSL	TCP	993	IMAP4 over SSL uses TCP port 993. Before an Exchange server supports IMAP4 (or any other protocol) over SSL, you must install a trusted SSL certificate on the Exchange server. This can be a self-signed certificate or a purchased signed certificate.  Recommended for external access and BYOD environments.
POP3	TCP	110	Post Office Protocol (POP3), enables "standards-based" clients such as Outlook Express, Windows Mail, Live Mail and other POP3 enabled mail clients to access the e-mail server. As with IMAP4, in early versions of Exchange POP3 ran on top of the IIS Admin Service, and enables client access to the Exchange Information store. On more recent versions of Exchange POP3 runs as two services (Microsoft Exchange POP3 and Microsoft Exchange POP3 Backend).
POP3/SSL	TCP	995	POP3 over SSL uses TCP port 995), encrypted version of POP3, suitable for environments where minimal server-side storage is needed.
NNTP	TCP	119	Network News Transport Protocol (NNTP), sometimes called Usenet protocol, enables client access to public folders in the Information store. As with IMAP4 and POP3, NNTP runs on top of the IIS Admin Service.
NNTP/SSL	TCP	563	NNTPS over SSL uses TCP port 563.
HTTP	TCP	80	Hyper-Text Transfer Protocol is the protocol used by IIS but Exchange Server adds a back end to IIS for mostly servicing requests under HTTPS.  However the below requests are handled by HTTP : AutoDiscover.  This is fallback when HTTPS isn't available Outlook WebAccess (OWA).  Usually a redirect to HTTPS OWA Unencrypted connections if Exchange has been configured to do so.
HTTP/SSL	TCP	443	HTTPS over SSL.  Technically the HTTPS port is part of IIS but Microsoft Exchange adds an addition site to IIS called "Exchange Back End".  This site will service the following Exchange Requests: Autodiscover service Exchange ActiveSync Exchange Web Services (EWS) Offline address book (OAB) distribution Outlook Anywhere (RPC over HTTP) Outlook MAPI over HTTP Outlook WebAccess (OWA) aka Webmail
SMTP	TCP	25	Simple Mail Transfer Protocol (SMTP) is the foundation for all e-mail transport in Exchange. The SMTP Service (SMTPSvc) runs on top of the IIS Admin Service. Unlike IMAP4, POP3, NNTP, and HTTP, SMTP in Exchange does not use a separate port for secure communication (SSL), but uses a security sub-system called Transport Layer Security (TLS). Send Connectors and Receive Connectors can be configured for incoming mail and outgoing SMTP emails. Services like outMail are useful services to relay outbound SMTP messages.
SMTP/SSL	TCP	465	SMTP over SSL. TCP port 465 is reserved by common industry practice for secure SMTP communication using the SSL protocol. However SMTP typically still uses port 25 and use TLS for its security layer. Send Connectors and Receive Connectors can be configured for incoming and outgoing SMTP emails.
SMTP/LSA	TCP	691	The Microsoft Exchange Routing Engine (RESvc) listens for routing link state information on TCP port 691. Exchange uses routing link state information to route messages and the routing table is constantly updated.
X.400	TCP	102	TCP port 102 is the port that the Exchange message transfer agent (MTA) uses to communicate with other X.400-capable MTAs.
MS-RPC	TCP	135	Microsoft Remote Procedure Call is a Microsoft implementation of remote procedure calls (RPCs). TCP port 135 is actually only the RPC Locator Service, which is like the registrar for all RPC-enabled services that run on a particular server. In Exchange 2000, the Routing Group Connector uses RPC instead of SMTP when the target bridgehead server is running Exchange 5.5. Also, some administrative operations require RPC. To configure a firewall to enable RPC traffic, many more ports than just 135 must be enabled.
ULS	TCP	522	User Locator Service (ULS) is a type of Internet directory service for conferencing clients, such as NetMeeting. Exchange 2000 Server and Exchange 2000 Conferencing Server do not implement a ULS, but rather take advantage of Active Directory for directory services (by TCP port 389).
DNS	UDP/TCP	53	Domain Name System (DNS) is at the heart of all of the services and functions of Windows Active Directory and Exchange Server.

Looking for the IP Addresses...

Above in this article is a full list of the ports used by MS Exchange but if you're looking for the IP Addresses used by the services below then please see the relevant article.

• outMail IP Addresses.
• profilter IP Addresses.
• DNS-Engine IP Addresses.
• Microsoft Office 365 IP Addresses.