Ports and TLS: 587 with auth vs port 25 with an allowlist

How your server connects to the smarthost depends on which authentication mode you choose, and the two modes use different ports.

Port 587 with SMTP authentication (recommended). Your server connects to smtp.mxguard.uk on port 587 over STARTTLS and presents a unique per-domain username and password (SASL). This works from any IP, the credentials can be rotated freely, and the account is constrained to your sender domain so nobody can spoof another customer.

Port 25 with IP allowlist. If your server has a stable static IP, you can instead give us that IP (for example 203.0.113.5 or a range like 198.51.100.0/29) and connect on port 25 over STARTTLS with no credentials. Simplest for fixed-IP datacentre servers.

Both modes use TLS to encrypt the submission. Choose 587-with-auth unless you have a specific reason (a fixed IP and a server that can't easily do SASL) to prefer the allowlist.