Port 691: MS-Exchange-Routing — The routing protocol that lived inside your mail server

Port 691 is the official IANA-assigned port for MS-Exchange-Routing—Microsoft Exchange Server's internal routing service that maintained routing tables between mail servers in an organization.¹²

What It Does

The Microsoft Exchange Routing Engine (RESvc) used port 691 to exchange routing information between Exchange servers. When you had multiple Exchange servers across different locations, they needed to know the best path to deliver email to each other. Port 691 carried that information.³⁴

This wasn't simple message delivery. This was routing protocol traffic—link state advertisements, topology updates, path calculations—happening between mail servers the same way routers exchange routing information on the Internet.

How It Worked

Exchange 2000 and 2003 used a Link State Algorithm to propagate routing information. Servers advertised their status and connectivity to each other using the Open Shortest Path First (OSPF) protocol over TCP port 691.⁵

When a server's status changed—a connector went down, a new routing group came online, a link became congested—that information flooded through port 691 to all other Exchange servers. Each server maintained a complete routing table of the organization's email topology. Every email sent could be routed along the shortest, fastest path.

The routing table updated constantly. Port 691 carried the heartbeat of Exchange's internal routing intelligence.

The Routing Group Era

In large organizations with hundreds or thousands of Exchange servers, routing groups organized servers into logical clusters. Within a routing group, servers connected directly. Between routing groups, designated bridgehead servers established connections over port 691 to exchange routing information.⁶

It was genuinely strange: inside your enterprise network, Exchange servers were running routing protocols like autonomous systems on the Internet. Advertising link states. Calculating shortest paths. Building spanning trees. All to route email efficiently.

Why This Exists

Before Exchange 2000, message routing was static and administratively complex. If you wanted to change how mail flowed between servers, you manually configured connectors and routing tables. When topologies changed—servers added, links failed, sites reorganized—administrators had to update configurations everywhere.

Microsoft solved this by giving Exchange servers a routing protocol. Let them discover each other. Let them calculate the best paths automatically. Let routing be dynamic, resilient, self-healing.

Port 691 was the channel for that intelligence.

The End of an Era

Modern Exchange versions (2007 and later) abandoned routing groups entirely. Active Directory Sites and Services replaced the routing infrastructure. Exchange servers now use AD site topology to determine message routing—no more OSPF, no more link state advertisements, no more port 691.⁷

If you see port 691 traffic today, you're looking at legacy Exchange 2000 or 2003 infrastructure. It's still running in some large organizations, quietly maintaining routing tables the way it has since 2000.

Security Considerations

Port 691 should only be accessible to Exchange servers within your organization. It carried routing table information—topology data that revealed your email infrastructure's structure. Exposing it externally would leak information about your internal architecture.

In legacy Exchange deployments:

• Restrict port 691 to Exchange server-to-server communication
• Don't allow external access
• Monitor for unauthorized connections
• Consider this a sign you're running very old Exchange versions that may have other security concerns

Check What's Listening

On Windows, check if anything is listening on port 691:

Get-NetTCPConnection -LocalPort 691

On Linux or macOS:

lsof -i :691
netstat -an | grep 691

If you find port 691 in use, you're almost certainly looking at Exchange 2000 or 2003.

Related Ports

• Port 25 — SMTP (how Exchange actually delivers email)
• Port 135 — RPC (how Exchange clients communicate with servers)
• Port 389/636 — LDAP/LDAPS (how Exchange queries Active Directory)
• Port 443 — HTTPS (Outlook Web Access, Exchange Web Services)