How SMTP Connection Testing Works
The SMTP Connection Tester evaluates mail server accessibility by attempting to establish TCP connections on the three standard SMTP ports: port 25 (server-to-server relay), port 465 (implicit TLS/SSL), and port 587 (message submission with STARTTLS). For each port, the tool records whether the connection succeeds or times out, captures the SMTP banner message that the server sends upon connection, and then performs an EHLO handshake to discover the server's supported extensions and capabilities. The EHLO response reveals critical information including supported authentication mechanisms (LOGIN, PLAIN, CRAM-MD5, XOAUTH2), maximum message size limits, pipelining support, and whether the server advertises STARTTLS for encryption upgrades.
When STARTTLS or implicit TLS is available, the tool initiates a TLS handshake and inspects the server's SSL/TLS certificate. It reports the certificate issuer, subject, expiration date, protocol version (TLS 1.2, TLS 1.3), and cipher suite in use. Expired, self-signed, or hostname-mismatched certificates are flagged as security warnings. The tool also measures connection latency for each port, providing insight into server responsiveness. If the server implements connection-level protections like rate limiting or IP-based access control, the tool reports the specific error codes returned. This comprehensive port-by-port analysis gives you a complete picture of how the mail server behaves from the perspective of an external sender attempting to deliver or submit email.
When to Use This Tool
- Verifying mail server configuration after setup or migration — After deploying a new mail server or migrating to a new hosting provider, test that all required SMTP ports are open, TLS is properly configured, and the server responds with correct banners and capabilities.
- Troubleshooting email delivery failures — When emails to a specific domain bounce with connection errors, use this tool to check whether the recipient's mail server is reachable on port 25 and whether TLS negotiation succeeds, which helps determine if the problem is on the recipient's side.
- Auditing TLS and security configuration — Verify that your mail server supports modern TLS versions, uses a valid non-expired certificate, and does not fall back to unencrypted connections. Many compliance frameworks and email providers now require TLS support for email transmission.
- Testing firewall and network rules — After changing firewall configurations, cloud security groups, or network ACLs, confirm that SMTP traffic is flowing correctly on the expected ports and that no legitimate SMTP connections are being blocked by overly restrictive rules.
Understanding Your Results
The results are organized by port, with each port showing its connection status, response time, and server details. Port 25 is used for server-to-server mail delivery and must be open for your domain to receive email from other mail servers on the internet. If port 25 is closed or filtered, external servers cannot deliver mail to your domain. Port 587 is the standard submission port used by email clients (Outlook, Thunderbird, mobile apps) to send outgoing mail through your server. It typically requires authentication and STARTTLS encryption. Port 465 provides implicit TLS, where the entire connection is encrypted from the start without a STARTTLS upgrade step.
The TLS details section is particularly important for security assessment. A server that does not support TLS on any port transmits email credentials and message content in plain text, which is a significant security risk. The certificate information tells you whether the certificate is valid, matches the server hostname, and has not expired. An expired certificate will cause many sending servers to refuse delivery or downgrade to unencrypted transmission. The server capabilities listed in the EHLO response tell you what features the server supports. Look for 8BITMIME (proper handling of international characters), SIZE (maximum message size accepted), and PIPELINING (improved performance for bulk delivery). If the server advertises no authentication mechanisms on port 587, it may be misconfigured as an open relay, which is a serious security issue that will quickly lead to blacklisting.