SMTP Test
Test SMTP server connectivity and configuration
Opens a real TCP/TLS session to each mail host — no simulated data. The three standard SMTP ports 25, 465 and 587 are probed by default; paste multiple domains for a batch run.
Targets — one per line
Domain, mail host, email address or IP. MX records are resolved automatically when you enter a domain.
Ports
Ports to probe:
25 (relay/MTA), 465 (implicit TLS), 587 (submission). These are the only standard SMTP ports.
Ready to test
Paste one or more domains, mail hosts or IPs and run the test. Results appear as each host finishes.
About This Tool
This page provides original, human-reviewed information about SMTP connection testing. Every result comes from a real TCP or TLS session opened to the mail host: the 220 banner, the full EHLO capability list, STARTTLS negotiation, certificate details, AUTH mechanisms and an open-relay probe. You can batch-test domains, read the raw session transcript, and see which platform answers — Postfix, Exim, Exchange, Gmail, Coremail, a secure email gateway or a cloud relay.
SMTP testing, explained
Everything you need to read the results above: what a real SMTP session looks like, what each port is for, how mail platforms are identified, and how to fix what breaks.
What this test actually does
This is not a simulated result. Every row below comes from a real TCP (or TLS) session opened from our probe node to your mail host.
- 1Resolve the domain's MX records (or use the host name you typed) to find the machine that answers for mail.
- 2Open a TCP connection to port 25, 587 and 465 in parallel and measure the handshake time.
- 3Read the 220 greeting (the banner) the server prints when the connection opens.
- 4Send EHLO, capture the full capability list, then upgrade with STARTTLS when it is offered.
- 5Re-send EHLO inside TLS — this is where most servers reveal their AUTH mechanisms.
- 6Optionally probe one RCPT TO for a foreign domain to see whether the host relays for anyone.
- 7Send QUIT and close. No message body is ever transmitted.
Nothing is delivered, no mailbox is touched and no credentials are sent. The relay probe issues MAIL FROM / RCPT TO and stops — a server that answers 250 there is a relay risk, but no mail leaves the session.
Because the probe runs in the cloud, a port that answers from your laptop can still time out here: many hosting providers and ISPs filter outbound port 25. When 25 times out but 465/587 answer, we flag it as an egress block rather than a server fault.
Ports 25, 465 and 587
Three ports, three different jobs. Testing all of them is what tells you whether a host can receive mail, whether your applications can submit mail, and how both are encrypted.
| Port | Role | Encryption | Who connects |
|---|---|---|---|
| 25 | Server-to-server relay (inbound MX) | Opportunistic STARTTLS | Other mail servers on the internet |
| 587 | Message submission (RFC 6409) | STARTTLS, then usually required AUTH | Mail clients and applications |
| 465 | Implicit TLS submission (RFC 8314) | TLS from the very first byte | Clients that prefer no clear-text handshake |
- Port 25 is the only port other mail servers will ever use to reach you. If it is closed or filtered, inbound mail bounces.
- Port 587 is the correct default for applications. It expects AUTH, which lets the server separate authenticated users from the open internet.
- Port 465 is not obsolete. RFC 8314 formally re-registered it for implicit TLS, and many providers now recommend it over STARTTLS because it removes the downgrade window.
- Port 25 being unreachable from our probe does not automatically mean misconfiguration — residential ISPs, AWS, GCP and most serverless platforms block outbound 25 by default.
A host that answers on 25 but not on 587/465 is a receiving-only MX. That is normal for inbound gateways — but your own applications must not be pointed at it; use your provider's dedicated submission relay instead.
Reading the SMTP conversation
The transcript tab shows the raw dialogue. Once you can read it, you can debug any delivery problem without guessing.
A healthy port 587 session
S: 220 mail.example.com ESMTP Postfix C: EHLO client.example.org S: 250-mail.example.com S: 250-PIPELINING S: 250-SIZE 52428800 S: 250-ETRN S: 250-STARTTLS S: 250-ENHANCEDSTATUSCODES S: 250-8BITMIME S: 250-DSN S: 250 SMTPUTF8 C: STARTTLS S: 220 2.0.0 Ready to start TLS C: EHLO client.example.org S: 250-AUTH PLAIN LOGIN S: 250-ENHANCEDSTATUSCODES S: 250 8BITMIME C: QUIT S: 221 2.0.0 Bye
Note how AUTH only appears after STARTTLS. That is deliberate: a server that advertises AUTH in clear text invites credential interception. We flag it when we see it.
| Keyword | Meaning |
|---|---|
| STARTTLS | Server can upgrade the connection to TLS on request. |
| AUTH | Authentication mechanisms offered (PLAIN, LOGIN, CRAM-MD5, NTLM, XOAUTH2). |
| SIZE | Maximum message size in bytes the server advertises. |
| 8BITMIME | Accepts unencoded 8-bit bodies; without it, content must be 7-bit or encoded. |
| PIPELINING | Client may send several commands without waiting for each reply (faster). |
| DSN | Delivery Status Notification — structured bounce reports. |
| ENHANCEDSTATUSCODES | RFC 3463 codes like 5.7.26 that explain failures precisely. |
| SMTPUTF8 | Accepts non-ASCII addresses and headers (internationalised mail). |
| REQUIRETLS | Client can demand TLS for every hop of the delivery chain. |
| CHUNKING / BINARYMIME | BDAT transfer of large or binary messages without dot-stuffing. |
Identifying the remote mail system
The banner, the EHLO name and the TLS certificate together identify the platform on the other side. We match them against a signature database and report a confidence level.
| Platform | Typical signature | What it tells you |
|---|---|---|
| Postfix | 220 host ESMTP Postfix | Self-hosted Linux MTA; banner often includes the version. |
| Exim | 220 host ESMTP Exim 4.96 | Self-hosted MTA, common on cPanel/Plesk hosting. |
| Microsoft Exchange | Microsoft ESMTP MAIL Service, Version: 15.x | On-premises Exchange; version maps to a specific CU. |
| Exchange Online / M365 | *.mail.protection.outlook.com | Tenant is hosted; inbound filtering handled by Microsoft. |
| Google Workspace / Gmail | mx.google.com / *.google.com ESMTP | Hosted mailbox, strict TLS and authentication requirements. |
| Coremail | Coremail SMTP(Anti Spam) System | Widely deployed in China; also powers NetEase 163/126. |
| Tencent QQ / 企业邮 | *.qq.com, mxbiz*.qq.com | Hosted mailbox; inbound IP allowlists are enforced strictly. |
| Zimbra | 220 host ESMTP ready Zimbra 9.0 | Collaboration suite with its own MTA stack. |
| Proofpoint / Mimecast / IronPort | *.pphosted.com, *.mimecast.com, IronPort banner | Traffic passes a secure email gateway — a rejection here is a policy decision, not a mail-server failure. |
| SendGrid / Amazon SES / Mailgun | smtp.sendgrid.net, email-smtp.*.amazonaws.com | Transactional relay — designed for submission, never for receiving mail. |
Confidence is reported honestly. A banner match is high confidence; a hostname or certificate match alone is medium; a generic "ESMTP" banner with no vendor string stays unidentified rather than being guessed.
Diagnosing failures
Match what you saw in the results to the symptom, then apply the fix in the right order — DNS first, then reachability, then TLS, then authentication.
| Symptom | Likely cause | What to do |
|---|---|---|
| All three ports time out | Firewall, security group, or the host is down; DNS points to a stale IP. | Confirm the A record resolves to the current IP, then open 25/465/587 inbound at the network edge. |
| Port 25 times out, 587/465 answer | Outbound port 25 filtered by your network or by our cloud region. | Re-test from a different network, or use an external port check; inbound mail is unaffected by outbound filtering. |
| Connection refused on 25 | Nothing is listening, or the service is bound to the wrong interface. | Check the MTA is running and listening on 0.0.0.0:25, not only 127.0.0.1. |
| 421 Service not available | Rate limiting, greylisting, or connection throttling. | Retry after a delay; do not open many parallel connections to the same host. |
| 530 5.7.0 Authentication required | Submission port requires AUTH before MAIL FROM. | Enable SMTP AUTH on the client; on port 25 use your provider's relay instead. |
| 550 5.7.26 / 550 relay denied | Sender domain fails SPF/DKIM/DMARC, or the host does not relay for you. | Publish SPF and DMARC, align DKIM, and send through an authorised relay. |
| Certificate hostname mismatch | Certificate covers a different name than the MX host that answered. | Reissue the certificate with the MX hostname in CN or SAN; keep SAN coverage for every MX name. |
| No STARTTLS on port 25 | TLS not configured on the inbound listener. | Install a valid certificate and enable opportunistic TLS; add MTA-STS and TLSRPT to make it enforceable. |
| Server accepted RCPT for a foreign domain | Open relay — anyone can push mail through this host. | Restrict relay rules to authenticated sessions and your own domains immediately; you are likely already blacklisted. |
Hardening checklist
What a well-configured mail host looks like when you test it from the outside.
- Port 25 answers with a 220 banner whose hostname resolves forward and backward (PTR matches).
- STARTTLS is advertised on 25 and negotiates TLS 1.2 or higher with a certificate that matches the MX name.
- 587 is open for submission and requires AUTH; AUTH is only advertised inside TLS.
- Relay is denied for domains the server does not host.
- SPF, DKIM and DMARC are published, so the 550 rejections you see are about reputation, not identity.
- MTA-STS plus TLSRPT are configured, so downgrade attempts are refused and reported.
- DANE TLSA records are published if your zone is DNSSEC-signed — the strongest form of inbound TLS enforcement.
- Certificate expiry is monitored; aim to renew with at least 30 days of margin.
The score on each result is a weighted read of the checks above, not a deliverability grade. It ignores reputation and content entirely — use the blacklist and spam tools for that half of the picture.
Provider quick reference
Submission settings for the platforms people test most often. Use these as a sanity check when your own server behaves differently.
| Provider | Submission host | Port | Notes |
|---|---|---|---|
| Gmail / Google Workspace | smtp.gmail.com | 587 / 465 | Requires an app password or OAuth; personal accounts block plain SMTP by default. |
| Microsoft 365 | smtp.office365.com | 587 | Authenticated SMTP may need to be enabled per mailbox in the admin centre. |
| Yahoo Mail | smtp.mail.yahoo.com | 587 / 465 | App password required when 2FA is on. |
| QQ Mail / 腾讯企业邮 | smtp.qq.com / smtp.exmail.qq.com | 465 / 587 | Uses an authorization code, not the mailbox password. |
| NetEase 163 / 126 | smtp.163.com / smtp.126.com | 465 / 994 | SMTP must be switched on in the web settings first. |
| Amazon SES | email-smtp.<region>.amazonaws.com | 587 / 465 | Region-specific host; credentials are SMTP keys, not AWS access keys. |
| SendGrid | smtp.sendgrid.net | 587 / 465 | Username is literally apikey; the password is the API key. |
| Zoho Mail | smtp.zoho.com | 587 / 465 | Region variants exist (smtp.zoho.eu, smtp.zoho.in). |
Frequently Asked Questions
Related Tools
MX Lookup
Check mail servers
Email Blacklist Checker
Check IP reputation
DNS Lookup
DNS record queries
SPF Checker
Validate SPF records
DMARC Checker
Check and analyze DMARC records
Email Header Analyzer
Analyze email headers
DKIM Checker
Verify DKIM signatures
WHOIS Lookup
Domain registration info
SMTP Test
Test SMTP connectivity
SSL Certificate Lookup
Check SSL certificates
DNS Propagation Checker
Check DNS propagation
Ping Test
Test network connectivity
Traceroute
Trace network path
Subnet Calculator
Calculate IP subnets
What Is My IP
Check your IP address
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.
Free to UseNo RegistrationReal-time Results