diff --git a/CHANGES b/CHANGES
index 3b0f5129b..8ec31d535 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2345,4 +2345,5 @@
 * Logout users without 2FA when mandatory 2fa is enabled
 * notifications: better oom message for redis
 * Add way to impersonate users for presetup
+* mail: open up port 465 for mail submission (TLS)
 
diff --git a/src/mail.js b/src/mail.js
index 6831d4927..c211a9d17 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -692,7 +692,7 @@ async function configureMail(mailFqdn, mailDomain, serviceConfig) {
 
     const allowInbound = await createMailConfig(mailFqdn, mailDomain);
 
-    const ports = allowInbound ? '-p 587:2587 -p 993:9993 -p 4190:4190 -p 25:2587' : '';
+    const ports = allowInbound ? '-p 587:2587 -p 993:9993 -p 4190:4190 -p 25:2587 -p 465:2465' : '';
 
     const cmd = `docker run --restart=always -d --name="mail" \
                 --net cloudron \