Skip to content
Toolbox

SMTP Test

The SMTP test connects to your mail servers and checks banner, EHLO, STARTTLS and certificate. Plus why port 25 is often blocked by your ISP.

The SMTP-Test in the Mail category talks directly to a mail server, just like another mail server does when delivering. It shows whether the server is reachable, how it greets, which extensions it offers, whether STARTTLS works and which certificate it presents. It doesn’t send any mail.

The SMTP test requires a license and only runs in the desktop apps (macOS, Windows, Linux). In the web version and on iOS and Android it is hidden.

How to check

In the Domain oder Host[:Port] field, enter:

  • a domain, for example example.com. The app looks up the MX records and tests the first five mail servers one after another.
  • a host with port, for example mail.example.com:587. Exactly this server is tested.

Port selects where the app connects:

Port Purpose
25 (MX) delivery between mail servers. Test this when mail to your domain doesn’t arrive.
587 submission by mail clients with login, via STARTTLS.
465 (TLS) submission with TLS from the start.

A port in the input takes precedence over the selection.

What the test does

  1. Open a TCP connection (with TLS right away on 465), 15-second timeout.
  2. Read the greeting banner; code 220 is expected.
  3. Send EHLO and read the list of extensions.
  4. If offered: STARTTLS, TLS handshake and certificate check, then EHLO again.
  5. QUIT.

The tables show the Erweiterungen (extensions) with parameters, the Zertifikat (certificate: subject, issuer, validity, names, key, fingerprints) and the Zeiten (timings) of each step. The complete conversation with the server is under Rohdaten (raw data).

Findings

Finding (as shown in the app) Meaning and what to do
Banner: … OK, the server greeted.
Banner mit Code … The server refuses the connection, for example because your IP is blocked.
Banner kam erst nach … s Banner was slow: a deliberate delay (greet pause) or an overloaded server.
EHLO abgelehnt The server doesn’t accept the greeting.
STARTTLS funktioniert OK.
Kein STARTTLS Error: mail to this server travels unencrypted. Enable TLS on the mail server.
STARTTLS angeboten, aber abgelehnt The server offers TLS but can’t do it, usually because the certificate is missing from its configuration.
AUTH vor STARTTLS angeboten Login is offered before STARTTLS, so credentials could travel unencrypted. Only offer AUTH after STARTTLS.
Zertifikat wird vom System nicht als vertrauenswürdig eingestuft Certificate not trusted: self-signed, unknown CA, missing intermediate certificate, expired or wrong name.
Name … steht nicht im Zertifikat The certificate isn’t valid for this hostname.
Zertifikat läuft in … Tagen ab Expires soon: under 30 days a warning, under 14 days an error.
Maximale Mailgröße … MB Note from the SIZE extension.

The certificate findings are the same as for the TLS certificate check.

Port 25 is often blocked

Many internet providers block outgoing connections on port 25 for home and mobile connections, and corporate and guest networks often do the same. This stops infected computers from sending spam. For the SMTP test, it means the connection never gets established.

You recognize it by this finding:

Keine Verbindung zu mail.example.com:25 Zeitüberschreitung. Sehr wahrscheinlich sperrt dieses Netz ausgehenden Port 25. (No connection, timeout. This network very likely blocks outgoing port 25.)

Every test on port 25 also includes a note that a timeout then isn’t the mail server’s fault.

What you can do:

  • Test from another network, for example from a server in a data center or through a VPN that allows port 25.
  • Test port 587. It’s rarely blocked. It shows whether the server is reachable at all and supports STARTTLS. It doesn’t prove that delivery from outside on port 25 works, though.
  • Use the port check to see whether other ports are affected too.

See also