Free tool

SMTP server test

Open a real SMTP connection and report what answers: the greeting and how long it took, the extensions advertised, STARTTLS and the certificate behind it, and whether the server will relay for strangers. No credentials, and nothing is sent.

Ports 25, 465, 587 and 2525 only. Enter a domain and we will test its lowest-preference MX. No credentials are ever asked for or accepted.

What this connection tells you

DNS says where mail should go; only a connection says what happens when it gets there. A server with perfect MX records can be refusing connections, presenting a certificate that expired last week, offering authentication over an unencrypted channel, or relaying for anyone who asks.

The four things worth checking

  • The greeting, and how long it takes. A delay of several seconds before 220 is usually deliberate — a tarpit or greylisting — and it is why some senders time out on you.
  • STARTTLS and the certificate. Opportunistic TLS tolerates an expired or mismatched certificate; MTA-STS and DANE do not, and the senders adopting those simply stop delivering.
  • AUTH on an unencrypted connection. A client that finds it offered will use it, and the password crosses the network readable.
  • Open relay. Rare now and catastrophic when it happens: the address ends up on every blocklist within days.

What this tool will not do

It connects only to ports 25, 465, 587 and 2525, and only to addresses on the public internet — a name that resolves to a private or reserved address is refused before a socket is opened. It never authenticates and never sends a message. It is a diagnostic for a server you are responsible for, not a scanner.

Sending, receiving, and the difference

This tests the server. Whether receivers trust the mail it sends is a different question, answered by SPF, DKIM and DMARC — and if a specific message went astray, its headers carry the receiver's own verdict.

Questions

Which port should I test?

25 for a server that receives mail from the internet, 587 for submission from an application, 465 for submission over implicit TLS. 2525 is an alternative submission port some providers offer where 587 is blocked. Those four are the only ports this tool will connect to.

Do I enter a hostname or a domain?

Either. Given a domain, the tool resolves its MX records and tests the lowest-preference one, and tells you which host that was — which is what you want when checking whether mail can reach a domain at all.

Will you ask for my SMTP password?

No, and it would not be safe if we did. The tool reports which authentication mechanisms the server advertises and never attempts to use them. Nobody should type a mail password into a public web page, ours included.

What does the open relay check actually do?

It offers a sender and a recipient in reserved domains that cannot exist, and stops at RCPT TO. If the server accepts that recipient it would carry mail from any stranger to anyone, which is the definition of an open relay. RSET follows immediately; DATA is never sent and no message exists.

It says unreachable but my server works.

Most likely the firewall between us and it — many networks block port 25 in both directions, including some clouds. Test 587 as well: if submission answers and 25 does not, the port is filtered somewhere in between rather than closed on your server.

Check another record

◈Email DNS checkSPF, DKIM, DMARC, MX and more in one report, with a score.◆SPF checkerRead the policy, follow every include, count the ten-lookup budget.▣DKIM checkerFind the key, read its size, and catch a revoked or test-mode record.▲DMARC checkerPolicy, reporting, alignment — and whether reports actually arrive.▤MX checkerWhere mail is delivered, and the mistakes DNS will not report.▥Email header analyzerPaste the headers: the receiver's verdict, alignment, and where the time went.◇DMARC generatorBuild a record you can publish, and know what each tag will do.