Port 25 is meant for server-to-server exchange and accepts mail for local domains without login. Submission on port 587 separates user sending from that: SMTP AUTH is required and the connection is upgraded with STARTTLS. Port 465 offers the same with TLS from the first byte and is recommended again since RFC 8314.
For applications such as Nextcloud, ticket systems or monitoring, 587 or 465 is the right choice. Sending through port 25 without authentication usually ends with Relay access denied or is blocked by the provider.
Common mistake in app settings: port 465 combined with STARTTLS, or port 587 combined with SSL/TLS. The connection then hangs or fails during the handshake.
Example
swaks --to test@example.org --server mail.example.com:587 --tls --auth-user user@example.com