--- title: Free Mail Server Checker — SMTP, IMAP & POP3 Grade description: Enter a domain and get an A+ to F grade for every one of its mail servers — inbound MX, SMTP submission, IMAP and POP3. Checks TLS versions and ciphers, certificates, STARTTLS, plain-text logins, open relay, reverse DNS, MTA-STS, TLS-RPT and DANE, from three regions at once, with the exact fix for every problem. No login, no test message sent. canonical: https://watchfor.io/mail-server-checker --- [Back to all free tools](/free-tools) # Mail Server Checker Enter a domain and get an A+ to F grade for every one of its mail servers — inbound MX, SMTP submission, IMAP and POP3. Checks TLS versions and ciphers, certificates, STARTTLS, plain-text logins, open relay, reverse DNS, MTA-STS, TLS-RPT and DANE, from three regions at once, with the exact fix for every problem. No login, no test message sent. Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## The mail server grade scale Every server gets one of these grades, each service takes the grade of its weakest server, and the overall grade is the weakest graded service. Services that don't answer are not graded: a server we could not reach, or a service a host does not offer, gets no grade and does not lower the overall grade. A+ Excellent TLS 1.3, a trusted certificate, no legacy protocols, no password before encryption. For mail apps: implicit TLS. For inbound mail: protected against STARTTLS stripping by MTA-STS (enforce + TLS-RPT) or DANE. A Good Secure, one step short of A+: usually TLS 1.2 as the highest version, STARTTLS without an implicit-TLS port, or inbound mail without MTA-STS or DANE. B Needs attention A real weakness: TLS 1.0/1.1 still accepted next to modern versions, RC4 or 3DES, no forward secrecy, a certificate expiring within 14 days, or an MX without matching reverse DNS. C Weak Passwords accepted before encryption, no TLS 1.2 or 1.3 at all, a certificate about to expire, or a bad certificate on the inbound MX. F Failing Mail or passwords can travel in clear text, the certificate mail apps see is broken, TLS fails, SSL 3.0 or a NULL/EXPORT cipher is on — or the server relays mail for anyone. ## Every rule, in full A server starts at A+ and each problem can only lower the ceiling, so the grade is always explained by the worst finding in the report. Rules version mailgrade-2026.10 . Grade at most When F Open relay: port 25 accepts mail for an outside domain from a stranger F No STARTTLS on port 25 or 587, or on 143/110 while a password login is offered F TLS handshake fails, SSL 3.0 enabled, or a NULL / EXPORT / DES cipher accepted F Mail-app ports (465, 587, 993, 995, 143, 110): certificate expired, not trusted, for another name, RSA key under 2048 bits or a SHA-1 signature C The same certificate problems on the inbound MX (port 25) — senders still encrypt, but nobody can verify the server. Waived when DNSSEC-validated DANE matches the certificate C Only TLS 1.0 / 1.1 — neither TLS 1.2 nor 1.3 is offered C Password login offered before encryption (IMAP without LOGINDISABLED, POP3 USER before STLS, SMTP AUTH before STARTTLS) C Certificate expires within 7 days C DANE records that do not match the certificate, or MTA-STS enforce that does not cover an MX or meets an invalid MX certificate B Certificate expires within 14 days B TLS 1.0 or 1.1 still accepted next to TLS 1.2 / 1.3 (as SSL Labs grades it) B RC4 or 3DES accepted, or no forward secrecy B MX address without a PTR record that resolves back to it B MTA-STS record published but its policy file cannot be fetched or read A TLS 1.2 is the highest version (no TLS 1.3) A Submission, IMAP or POP3 only over STARTTLS when no implicit-TLS port (465, 993, 995) exists A Inbound MX not protected against STARTTLS stripping — needs MTA-STS in enforce mode plus TLS-RPT, or DANE — Software version in the greeting: reported, not graded [How WatchFor grades everything the same way](/grades#mail-server) ## What is Mail Server Checker ? Your mail runs on several servers that most people never look at: the inbound MX servers that other companies deliver to, the submission server your apps and website log in to when they send, and the IMAP or POP3 server your mail app reads from. Each one has its own encryption settings, its own certificate and its own idea of when it accepts a password. When one of them is set up badly, nothing looks broken. Mail still flows, until a certificate expires on a Sunday, a phone app quietly sends a password in clear text, or a spammer finds that your old server relays mail for anyone. This free mail server checker takes a domain and tests all of them at once. It finds the servers from your DNS, connects to each one the way a mail client or another mail server would, and gives every service a grade from A+ to F with the reason and the fix next to each problem. It works as an SMTP test, an IMAP test and a POP3 test in one run, checks the SSL/TLS setup of every port, and reads your MTA-STS, TLS-RPT and DANE records. It runs from three regions, so you also see when a server answers in Europe but not in Asia. It never logs in and never sends a message. ## How it works One domain in, every mail server out. Here is what happens after you press the button: - 1 Find the servers — The MX records give the inbound servers (the first two, on port 25). For sending and reading, the checker looks for the SRV records mail apps use ( _submission._tcp , _submissions._tcp , _imaps._tcp , _imap._tcp , _pop3s._tcp , _pop3._tcp ), then the Thunderbird autoconfig file at https://autoconfig./mail/config-v1.1.xml , then common names such as imap. , mail. , smtp. , pop. and pop3. . At most two servers per service and eight in total are checked, and two names pointing at the same address and port count once. Every server is labelled with where it came from: MX, SRV, autoconfig or guessed. - 2 Talk to each server without logging in — The checker reads the greeting, asks for the server's capabilities (EHLO for SMTP, CAPABILITY for IMAP, CAPA for POP3), switches to encryption with STARTTLS where the port needs it, and asks again. That shows whether encryption is offered at all and whether the server would accept a password before it. No username or password is ever sent. - 3 Test the encryption — Separate short connections try each TLS version from TLS 1.3 down to TLS 1.0 and SSL 3.0, and offer only weak ciphers (NULL, EXPORT, DES, RC4, 3DES) to see whether the server takes one. The certificate is checked for a trusted chain, the right name, the expiry date, the key size and the signature. - 4 Check the inbound mail extras — On port 25 the checker tests for an open relay: it gives an outside sender and an outside recipient, notes the answer and resets the session. The message itself is never sent, so nothing is delivered. It also checks reverse DNS for each MX address, reads your MTA-STS record and policy file and compares the policy with your real MX hosts, looks for a TLS-RPT record and for DANE (TLSA) records, and shows a short SPF and DMARC summary. - 5 Compare three regions — Submission, IMAP and POP3 are graded from the location nearest to you. Inbound mail on port 25 is always graded from a location that can reach port 25, because most cloud networks block it, and the report says which one. Two more locations in other regions connect to the same servers and report whether they answered, which TLS version they got and which certificate they saw. Differences are reported but never change the grade, because a network problem between regions is not a setting on your server. Results appear service by service as each one finishes, usually within 10 to 30 seconds. The overall grade is the worst service grade, so one weak server cannot hide behind a good one. ## When you'd use it ### After moving mail to a new provider You changed MX records and the mail app settings. Check that the new MX servers answer everywhere, that the old IMAP host is really gone, and that the autoconfig file and SRV records point mail apps at the new servers instead of the old ones. ### Before a security review Auditors ask whether mail is encrypted in transit and whether old TLS versions are switched off. One run answers both for every mail server the domain has, with a link you can share instead of a stack of screenshots. ### Setting up MTA-STS or DANE MTA-STS breaks delivery when the policy names an MX host you no longer use or when an MX certificate does not match. Use it as an MTA-STS checker: it fetches the policy, compares every pattern with your real MX hosts and flags the mismatch before senders start refusing mail. ### A self-hosted or older mail server A server that has run for years often still accepts TLS 1.0, offers logins before STARTTLS or shows its exact software version in the greeting. The checker lists each of these with the setting that fixes it. ### Mail that arrives from some places but not others If partners in one country report delays, the three-region view shows whether port 25 answers from there. A firewall rule or geo-block on the server shows up as one region that cannot connect. ## Reading the result ### Service grades and the overall grade Inbound MX, submission, IMAP and POP3 each get their own grade, worked out from the servers found for that service. The overall grade is the worst of them. A service with no server found shows as not found, and a service we could not reach shows as not reachable. Neither one lowers the grade. ### Findings and fixes Problems are listed worst first. Each one says what it means in plain words, which grade it limits the result to, and the change that fixes it. The strong points are listed too, so you can see what is already right. ### STARTTLS and implicit TLS Ports 465, 993 and 995 are encrypted from the first byte (implicit TLS). Ports 25, 587, 143 and 110 start in plain text and switch to encryption with STARTTLS. Someone on the network path can remove the STARTTLS offer, so a mail app that does not insist on encryption falls back to plain text. For sending and reading, an implicit-TLS port avoids that. For inbound mail on port 25 there is no implicit option, which is what MTA-STS and DANE are for. ### "Password login before encryption" The server would accept a username and password on the connection before STARTTLS. A careless mail app, or one set to the wrong security option, then sends the password in clear text. The fix is to refuse logins until the connection is encrypted: LOGINDISABLED for IMAP, no USER before STLS for POP3, no AUTH before STARTTLS for SMTP. ### The region table One row per server, one column per location. Each cell shows whether the server answered from there, the TLS version and the certificate. A cell that says port 25 was not tested means that location's own network blocks outbound port 25, which many cloud providers do. In that case inbound mail is graded from a location that can reach port 25, and the result says so. ### Raw details Click a server to open its details: the greeting, the capability lists before and after encryption, the advertised login methods, the certificate chain and the TLS versions tested. These are the exact answers the server gave. ## Mail ports at a glance What each port is for and how encryption starts on it. Port Service Encryption Who uses it 25 Inbound mail (MX) STARTTLS Other mail servers delivering to you 587 Submission STARTTLS Mail apps and websites sending mail 465 Submission Implicit TLS Mail apps and websites sending mail 993 IMAP Implicit TLS Mail apps reading and syncing mail 143 IMAP STARTTLS Mail apps reading and syncing mail 995 POP3 Implicit TLS Mail apps downloading mail 110 POP3 STARTTLS Mail apps downloading mail ## Check it yourself The same STARTTLS test from a terminal, for one server at a time: openssl s_client -starttls smtp -connect mx.example.com:25 -servername mx.example.com -brief /.well-known/mta-sts.txt , announced by a _mta-sts TXT record, that tells sending servers to use TLS with a valid certificate when they deliver to your MX hosts. The checker fetches the policy, shows its mode ( testing or enforce ) and compares its MX patterns with your real MX records. Why did one region fail to connect? The server did not answer from that location while it did from another. The usual causes are a firewall or geo-IP rule on the server, a provider filtering traffic from that region, or a routing problem between networks. The difference is reported but does not change the grade. Is the grade the same as the one WatchFor monitors show? It uses the same rules. The IMAP, POP3 and SMTP monitors grade one server from each check; the checker grades every server of a domain at once and adds checks a single monitor cannot do, such as the TLS version matrix, weak ciphers, the open relay test and MTA-STS. The monitors keep checking around the clock and alert you when something changes. Does it check SPF, DKIM and DMARC? It shows whether SPF and DMARC records exist and what policy they set. For the full check, including DKIM with your selector, use the free Email Health tool. Those records protect your domain from spoofing; this tool grades the servers that carry the mail. ## Related email tools - [Email HealthCheck a domain's SPF and DMARC records in one run, with a letter grade. DKIM needs a selector, so it shows as not checked here; use the DKIM Checker for the key.](/email-policy-checker) - [SPF CheckerRead a domain's SPF record — its all policy, includes, a second-record check and a count of the DNS lookups the record itself makes (includes are counted, not followed).](/spf-record-checker) - [DKIM CheckerCheck the DKIM key published for a selector — the record, key type and key size, and whether the key is live or revoked.](/dkim-record-checker) - [DMARC CheckerRead a domain's DMARC record — policy, subdomain policy, pct, alignment modes and whether aggregate and failure reports are requested.](/dmarc-record-checker) --- Canonical page: https://watchfor.io/mail-server-checker · Site guide: https://watchfor.io/llms.txt