SMTP Server Test
Related tools
What this is
This check connects to your domain's highest-priority MX host on port 25, reads the greeting, sends EHLO, and inspects the advertised capabilities — the same first steps every sending server performs when delivering you mail.
How to read your result
Healthy: a 220 greeting naming your mail host, and STARTTLS among the EHLO capabilities. Important caveat: many networks (including cloud hosts) block outbound port 25, so a timeout from this tool can be the tool's environment rather than your server.
Common problems and how to fix them
Mail server does not answer on port 25
How it shows up: Inbound mail from the whole internet bounces with connection errors — or, if only this tool times out but mail flows fine, the tool's network is simply blocked.
How to fix it: Verify with an independent test from another network. If genuinely down: check the mail service is running, port 25 is open in every firewall/security-group layer, and the MX points at the right host.
STARTTLS not offered
How it shows up: All inbound mail arrives over plaintext connections; MTA-STS cannot be deployed; some senders downgrade or complain.
How to fix it: Enable STARTTLS in the mail server with a valid certificate for the MX hostname (self-signed works for opportunistic TLS but fails MTA-STS). On managed mail hosting this should already exist — if missing, escalate to the provider.
Greeting hostname mismatches the MX name
How it shows up: Elevated spam scores and occasional rejections from strict receivers.
How to fix it: Configure the server's announced hostname to match the MX record and give that name matching forward and reverse DNS.
Related reading
No article on this topic yet.
Other articles →Frequently asked questions
- What does the SMTP check tool do?
- It connects to the mail servers listed in your domain's MX records and reports each server's SMTP greeting banner, whether it offers STARTTLS, and the TLS details of the encrypted session. This shows how your mail servers respond to an incoming connection, just as a sending server would see them.
- How do I use it?
- Enter a domain name and run the check; the lookup happens server-side, so you don't install anything. It resolves the domain's MX hosts, opens an SMTP connection to each, and displays the banner, STARTTLS advertisement and negotiated TLS in the results.
- Why does STARTTLS support matter?
- STARTTLS lets a plain SMTP connection upgrade to an encrypted TLS session, protecting mail in transit from eavesdropping. A server that advertises and successfully negotiates STARTTLS can receive email over an encrypted channel instead of clear text.
- How do I read the result?
- The banner is the server's first line of response and often names the mail software or hostname; "STARTTLS supported" with valid TLS details means encrypted delivery is available. If STARTTLS is missing or TLS fails to negotiate, incoming mail may only be accepted in plain text and should be fixed on the mail server.
- Does a passing SMTP check mean my email is fully secure?
- No. This tool only inspects the transport-level banner, STARTTLS and TLS of the receiving connection; it does not validate SPF, DKIM, DMARC, certificate trust chains or anti-spam configuration. Treat it as one signal among several, not a complete email security audit.