Popular tools

Theme

SMTP Test: Check Any Mail Server

A free SMTP checker: test any mail server live on port 25, 587, 465 or 2525. See its greeting, TLS and certificate, and whether it relays for strangers. No password, no mail sent.

A live session from our test server in Mumbai · Google Public DNS · 4 root stores · Team Cymru · the IP Blacklist Check's lists
Test server online · Mumbai

Port 25: where servers deliver mail to each other. A domain or an e-mail address tests its MX servers.

Trygmail.comMXsmtp.gmail.com587smtp.gmail.com465smtp.office365.com587smtp.sendgrid.net2525
What the test checks, in order
  1. Connect
  2. Greeting
  3. EHLO
  4. STARTTLS
  5. Certificate
  6. EHLO after TLS
  7. Password login
  8. Relay check

One SMTP session from our test server: no password, no DATA, no mail sent. Answers are kept 2 minutes so repeat tests are fast; we keep no log of what you test.

What does an SMTP test check?

An SMTP test opens the same conversation a sending server would: it connects, waits for the 220 greeting, introduces itself with EHLO, switches to TLS with STARTTLS, checks the certificate, asks EHLO again, and on port 25 asks the server to deliver to a stranger's domain. Each step answers with a three-digit code, and the answers tell you what works.

We stop before anything leaves: no password, no DATA, so no e-mail is ever sent. Each step fails in its own way, and the way it fails says who has to fix it.

  1. 1Connect3 msfiltered · closed
  2. 2Greeting220 · 236 ms421 · 554 · silence
  3. 3EHLO250 · 245 ms500 → HELO
  4. 4STARTTLS220 · 233 ms454 · not offered
  5. 5TLS1.3 · 6 msold TLS · no shared cipher
  6. 6Certificatevalid · 58 dexpired · self-signed · wrong name
  7. 7EHLO again250 · 237 msAUTH before TLS
  8. 8Relay check550 · 475 ms250 = open relay
A real test of gmail-smtp-in.l.google.com on port 25 from our test server, 24 Oct 2026. Under each step: how it fails. The line under the steps is the connection: readable until STARTTLS, encrypted after it.
SMTP test of gmail-smtp-in.l.google.com on port 25: the verdict, each step and the SMTP conversation with STARTTLSSMTP test of gmail-smtp-in.l.google.com on port 25: the verdict, each step and the SMTP conversation with STARTTLSOne verdictWorking, working with problems, open relay, refused, not reachable: the answer in one sentence, with what it is based on.The factsThe address, its network, its reverse DNS name, the encryption, the certificate and the blocklists, at a glance.Step by stepEvery step of the session with the server's wait: connect, greeting, EHLO, STARTTLS, the certificate, EHLO again, login and the relay check.Where TLS startsThe whole conversation line by line. Above the seam it is readable on the way; below it, encrypted.
A real test of Gmail's mail server on port 25 from our test server. Select a number to see what each part shows.

Which SMTP port should you use: 25, 587, 465 or 2525?

Port 25 is for servers delivering to each other: it's where a domain's MX servers listen, and nobody logs in. Port 587 is where your mail app hands a message to your provider, after STARTTLS and a password (RFC 6409). Port 465 does the same with TLS from the first byte.

Port 2525 isn't a mail port at all in the IANA registry: it belongs to “ms-v-worlds”. SendGrid, Mailgun and Postmark open it because some networks block 587. And because spam once poured out of infected home computers, most clouds and many home providers block outgoing port 25 by default.

  • 587STARTTLS, then login
  • 465TLS first, then login
  • 2525where 587 is blocked
  • 25server to server, no login
Provider255874652525
Gmail / Google Workspacesmtp.gmail.com––✓✓––
Microsoft 365smtp.office365.com✓best✓no✕––
SendGridsmtp.sendgrid.net✓best✓✓✓
Mailgunsmtp.mailgun.org✓✓✓✓
Postmarksmtp.postmarkapp.com✓✓––✓

Outgoing port 25 blocked by default: AWS · Google Cloud · Azure · Comcast. Port 587 must stay open (RFC 5068).

Ports each provider's sending host accepts, from its own setup pages (October 2026). Microsoft 365 has no 465: it requires STARTTLS on 587.

SMTP reply codes: what 220, 250, 421, 550 and 554 mean

Every SMTP reply starts with three digits. The first says what to do: 2 done, 3 send more, 4 try again later, 5 don't retry. The second groups the subject (0 syntax, 2 connection, 5 the mail system), and the third is the detail.

Most servers add an enhanced code like 5.1.1 after it (when they list ENHANCEDSTATUSCODES): class, subject (1 addressing, 7 security or policy), detail. The text after the codes is for people and differs from server to server: read the numbers first.

  • 220Service readythe greeting · after STARTTLS
  • 221Closing the connectionafter QUIT
  • 250OK, doneEHLO · MAIL · RCPT · RSET
  • 354Start sending the messageafter DATA: we never get here
  • 421Not available now, closingthe greeting: busy or limits
  • 451Try again laterRCPT: greylisting
  • 454TLS not available right nowSTARTTLS
  • 530Log in firstMAIL on port 587
  • 535Wrong username or passwordAUTH: we never send one
  • 550Mailbox unavailable or not allowedRCPT: the relay check
  • 554No SMTP service herethe greeting: refused
The codes this test meets, and where. Colours by first digit: 2 done, 3 waiting, 4 temporary, 5 permanent (RFC 5321 §4.2; 454, 530 and 535 from RFC 3207 and RFC 4954).

STARTTLS vs implicit TLS: port 587 or 465?

With STARTTLS (port 587, and port 25 between servers) the conversation starts in plain text and switches to TLS halfway. Until the switch, anyone on the path can read it, and can quietly delete STARTTLS from the server's list: a sender without MTA-STS or DANE then carries on unencrypted.

With implicit TLS (port 465) the TLS handshake comes first, before the server says a word. RFC 8314 (2018) asks mail apps to prefer it; done right, both are equally safe. Between servers on port 25, only STARTTLS exists.

587STARTTLSsmtp.gmail.com
  1. ←220smtp.gmail.com ESMTP
  2. →EHLO probe.dnsrobot.net
  3. ←250SIZE · 8BITMIME · STARTTLS · …
  4. →STARTTLS
  5. ←2202.0.0 Ready to start TLS
TLS 1.3handshake 6 ms
  1. →EHLO probe.dnsrobot.net
  2. ←250SIZE · AUTH LOGIN PLAIN XOAUTH2 …
  3. →AUTH … (your app)

The first five lines travel readable: an attacker can strip STARTTLS here.

465Implicit TLSsmtp.gmail.com
TLS 1.3handshake 6 ms
  1. ←220smtp.gmail.com ESMTP
  2. →EHLO probe.dnsrobot.net
  3. ←250SIZE · AUTH LOGIN PLAIN XOAUTH2 …
  4. →AUTH … (your app)

Nothing travels readable: there is no STARTTLS to strip.

The same server, smtp.gmail.com, tested on both ports from our test server. The dashed rail is readable on the way; the cyan rail is encrypted.

EHLO: what the server's list of extensions means

A client opens with EHLO and its name; the server answers 250 with one line per extension it supports. That list is the server's menu: the largest message, whether it can switch to TLS, which login methods it takes.

After STARTTLS the client must forget the list and ask again (RFC 3207). A well-set server then drops STARTTLS and often adds AUTH, so passwords are only ever offered inside TLS. AUTH PLAIN or LOGIN in the list before TLS is a finding: an app could send the password in plain text.

  1. SIZE 35882577Largest message: 34.2 MBSIZE 35882577
  2. 8BITMIMEAccents and non-Latin text pass unchanged8BITMIME
  3. STARTTLSCan switch to TLS: offered only before itgone
  4. not yetPassword or OAuth login: offered only inside TLSAUTH LOGIN PLAIN XOAUTH2 …
  5. ENHANCEDSTATUSCODESReplies carry codes like 5.1.1ENHANCEDSTATUSCODES
  6. PIPELININGSeveral commands in one goPIPELINING
  7. CHUNKINGThe message in sized chunks (BDAT)CHUNKING
  8. SMTPUTF8Addresses like ü@example.comSMTPUTF8

Also seen: DSN delivery reports · VRFY “does this user exist?” (often off) · REQUIRETLS TLS on every hop · BINARYMIME raw binary with CHUNKING · ETRN backup servers fetch queued mail.

smtp.gmail.com on port 587: the reply to EHLO before and after STARTTLS. STARTTLS disappears and AUTH appears, as RFC 3207 and RFC 4954 ask.

SMTP relay test: is your mail server an open relay?

An open relay delivers mail for anyone to anywhere, so spammers look for them and blocklists list them. RFC 2505 has asked mail servers to refuse it since 1999, and submission servers must never relay without a login (RFC 5068).

On port 25 we ask the server, as a stranger, to deliver to someone else's domain: MAIL FROM our test address, then RCPT TO:<relay-test@example.com>. A 4xx or 5xx refuses: good. A 250 accepts: a strong sign of an open relay, though a few servers only refuse later, after DATA. We never send DATA, so nothing is delivered either way.

  1. MAIL FROM
  2. RCPT TO ?
  3. RSET
  4. DATA never
  5. QUIT
A refusal proves

this server won't relay for this stranger to this domain. Gmail answered 550 5.1.1: it won't take mail for example.com at all.

It doesn't prove

that it refuses everyone (it may trust some networks), and a 250 doesn't prove the mail would leave: a few servers refuse after DATA.

Our check, as it runs on port 25 only: four commands and QUIT. Ports 587 and 465 ask for a login first, so the check isn't run there.

Certificates on mail servers: MTA-STS and DANE

Between mail servers, a certificate is checked only if the receiving domain asks for it. Without a policy, a sender takes any certificate, even an expired one, and falls back to plain text if STARTTLS fails.

MTA-STS publishes a policy over HTTPS: deliver only over TLS, to these MX names, with a valid certificate. DANE pins the server's key in DNS (a TLSA record), which needs DNSSEC. Our test checks the certificate the MTA-STS way, against the server's own name, and shows the domain's policy beside it.

Name must match the MXNot expiredTrusted CANeeds DNSSECCan't be downgraded
Opportunistic STARTTLSno policy–––––
MTA-STSmta-sts.<domain>/.well-known/mta-sts.txt–
DANE_25._tcp.<mx> TLSA, signed zonekey matchkey matchnot needed
gmail.com's MTA-STS policy
version: STSv1
mode: enforce
mx: smtp.google.com
mx: gmail-smtp-in.l.google.com
mx: *.gmail-smtp-in.l.google.com
max_age: 86400
mx.google.com certificate · 26 names
mx.google.com
smtp.google.com
aspmx.l.google.com
gmail-smtp-in.l.google.com
alt1.gmail-smtp-in.l.google.com
… alt4, gmr-smtp-in, mx1.smtp.goog
valid until Dec 21, 2026 · Google Trust Services WE2
Gmail's live policy and the certificate its MX servers present (24 Oct 2026): every MX name in the policy is covered. gmail.com has no DANE: its zone isn't DNSSEC-signed.

How to test an SMTP server from your own computer

Our test runs from our server, so it shows what the internet sees. Whether your network lets you out on port 25 or 587 is a different question, and a web page can't answer it: browsers refuse to open ports 25, 465 and 587 at all (the Fetch standard's “bad ports”).

Run one of these on your own computer. On Windows, Test-NetConnection answers in a second. On macOS and Linux, openssl s_client does the STARTTLS upgrade for you and shows the certificate; then type EHLO test and you're talking SMTP. swaks scripts a whole session.

WindowsmacOSLinux
$ openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf
depth=0 CN=smtp.gmail.com
Protocol: TLSv1.3 · Cipher is TLS_AES_256_GCM_SHA384
Verification: OKtrusted
› EHLO test
250-smtp.gmail.com at your service
250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTHlogin inside TLS
250 SMTPUTF8
Our test serverport 25 open
Your computeryour ISP may block 25
A web page25 · 465 · 587 refused
A run from a laptop on 24 Oct 2026 (the address the server echoed is left out). The lanes: who can reach a mail server's port, and who decides.

Why a mail server refuses an SMTP test

A refusal isn't always a broken server. Mail servers defend themselves: they turn away addresses on blocklists, slow down or delay strangers, and limit how many connections one sender opens. Our test is a stranger to every server it calls, so it meets these defences first.

Read the first reply. A 4xx is temporary, and real senders retry. A 554 at the greeting or a 5xx at RCPT is a policy decision about the sender, which may not apply to yours. No answer at all is a network question, not an SMTP one.

  • Our address is blocked by policy5545.7.1 Service unavailable; client host blocked

    It turns away our test server, and maybe yours. Check its blocklists and the server's allow-list.

  • Too busy, or a rate limit4214.7.0 Too many concurrent SMTP connections

    Temporary: senders retry 421 for hours. Test again in a few minutes.

  • Greylisting4514.7.1 Greylisted, please try again later

    Unknown senders are asked to come back later. Real servers do, so mail arrives late, not lost.

  • A slow greeting (tarpit)… 18 s of silence … 220mail.example.net

    RFC 5321 lets senders wait 5 minutes. Our test waits 15 seconds and says so.

  • No reverse DNS for the sender5505.7.25 The IP address sending this message does not have a PTR record

    Gmail's answer to a sender without a PTR record. Our test server has one.

  • A firewall drops the connectionno answer in 10 s (filtered)

    The port lets only known senders in, or a network on the way blocks it.

The six refusals a test meets most, with the reply each one sends. The 550 5.7.25 text is Gmail's; the others are typical wording, which varies from server to server.

SMTP authentication: why this SMTP tester never asks for your password

Many SMTP testers ask for your username and password and send a real e-mail. We don't: a password typed into someone else's website is a password you have to change. The test shows what you need without it: whether the server offers login, by which methods, and only inside TLS.

Passwords are on their way out anyway. Google no longer lets apps sign in to Gmail with just your password, and Microsoft turns Basic authentication for SMTP AUTH off by default for existing tenants at the end of December 2026. If your app still logs in with a password, test it in the app, with an app password.

Login methods (IANA SASL registry)
  • PLAINcommon
  • OAUTHBEARERcommon
  • SCRAM-SHA-256common
  • CRAM-MD5limited
  • LOGINobsolete
  • XOAUTH2obsolete
  • DIGEST-MD5obsolete

XOAUTH2 is marked obsolete, but it's what Gmail and Microsoft 365 apps use today.

Password login for SMTP: the end dates
Google
Mar 14 / May 1, 2025: Workspace stops password sign-in
Microsoft 365
Basic auth unchangedend Dec 2026: off by default

Microsoft will announce the final removal date in the second half of 2027. Google's own pages give two dates for Workspace.

Status from the IANA SASL mechanisms registry; dates from Google's and Microsoft's announcements (Microsoft's of 27 Jan 2026).

SMTP test: frequently asked questions

What is an SMTP test, and what does an SMTP checker show?

An SMTP test opens a real SMTP session with a mail server, the way a sending server would, and reads every answer: the greeting, the extensions, the TLS upgrade, the certificate and, on port 25, whether it relays mail for strangers. This SMTP test tool stops before DATA and never logs in, so no e-mail is sent and no password is needed.

How do I test an SMTP server?

Type the server's name (smtp.example.com) or IP address, or a domain or e-mail address to test its MX servers, pick the port and press Test. The result shows each step with its time, the whole conversation and what to fix. To test from your own network instead, use the commands under the result: Test-NetConnection on Windows, openssl s_client on macOS and Linux.

Which port should I use: 25, 587, 465 or 2525?

Mail apps and websites send through their provider on port 587, with STARTTLS and a password, or on port 465, with TLS from the first byte. Servers deliver to each other on port 25, without a login. Port 2525 is an unofficial alternative that SendGrid, Mailgun and Postmark open where 587 is blocked; it isn't a mail port in the IANA registry.

Is my ISP blocking port 25 or 587?

Our test can't tell, because it runs from our server. AWS, Google Cloud, Azure and many home providers such as Comcast block outgoing port 25 by default; RFC 5068 says providers must not block 587. To check your own network, run Test-NetConnection smtp.gmail.com -Port 587 in PowerShell, or nc -vz smtp.gmail.com 587 on macOS and Linux. A timeout means a block.

What do 220, 421 and 554 mean in an SMTP test?

220 is the greeting: the server is ready and names itself. 421 means “not now”: the server is busy or limiting connections and closes the line, so try again later. 554 at the greeting means it refuses to talk to this sender at all, often because of a blocklist or a policy; senders it trusts may still get through.

What is STARTTLS, and is it required?

STARTTLS switches a plain SMTP connection to TLS, so the rest of the conversation is encrypted. Submission servers on port 587 usually require it before you can log in. A public mail server on port 25 must not require it to accept mail, but it should offer it: Gmail, Microsoft 365 and most providers do, and our test flags a server that doesn't.

Why does my SMTP test time out?

No answer at all within 10 seconds means the port is filtered: a firewall drops the connection, or the server only accepts known senders. That's different from a refused connection, where the machine answers at once and nothing listens on the port. A server with only an IPv6 address can't be reached from our test server yet; the result says so instead of “down”.

Can you test SMTP authentication with my username and password?

No, on purpose: this SMTP tester never takes passwords. It shows which login methods the server offers and whether it offers them only inside TLS, which is what a password test would expose. To test your own login, use your mail app, or swaks on your own computer with an app password, so the password never leaves your machine.

How does the open relay test work?

On port 25 our test server asks the mail server, as a stranger, to deliver to an address at example.com. A refusal (4xx or 5xx) is good. A 250 is a strong sign of an open relay, which anyone could use to send spam. We stop before DATA, so nothing is delivered, and a few servers that accept here refuse later anyway.

What's the difference between EHLO and HELO?

Both open the conversation with the client's name. HELO is the older command and gets a plain OK. EHLO asks the server to list its extensions too: SIZE, STARTTLS, AUTH and the rest. Every current server answers EHLO; a client falls back to HELO only when EHLO is refused, and our test flags a server that needs it.

Does the SMTP test send an e-mail?

No. Our test server says QUIT before DATA, the command that starts a message, and never logs in. The mail server sees a short conversation from probe.dnsrobot.net and nothing reaches any inbox. To check how a real message is received, use our Email Checker, which reads a mail you send to it.

What are Gmail's and Outlook's SMTP settings?

Gmail: smtp.gmail.com, port 587 with STARTTLS or 465 with TLS, signing in with OAuth or an app password. Microsoft 365: smtp.office365.com, port 587 with STARTTLS; it has no implicit TLS on 465. Outlook.com: smtp-mail.outlook.com on 587, with modern sign-in. The example buttons above test the first two.

Missing something?Suggest a feature or a new tool

More e-mail and DNS tools