--- title: SMTP Monitoring for Mail Servers description: SMTP monitoring by WatchFor. Check that your mail servers answer with a banner and EHLO, offer STARTTLS, aren't an open relay and, with a login, still accept authenticated sending on 587 or 465. canonical: https://watchfor.io/smtp-monitoring --- # SMTP Monitoring for Outbound & Inbound Mail Servers Hear that your mail server is failing before customers say your email never arrived. WatchFor reads the banner, sends EHLO, checks STARTTLS and tests for an open relay, and with a login it checks that your apps can still authenticate and send. [Get started for free](/auth/sign-up)[View pricing](/pricing) [IMAP monitoring](/imap-monitoring)[POP3 monitoring](/pop3-monitoring)[Email round-trip monitoring](/email-round-trip-monitoring) ## SMTP Monitoring Features What each check tests on your mail server ### Banner & EHLO Exchange We open a real connection, wait for the greeting banner and send EHLO, so you know mail software is answering, not just a TCP port. The check ends with QUIT and never sends a message. ### STARTTLS Offered Each check records whether the server offers STARTTLS in its EHLO reply; port 465 always counts as encrypted. Turn on the TLS Required rule to hear when a server stops offering encryption. ### Open Relay Test Each check offers a sender and a recipient on outside domains and stops at the recipient reply. Open Relay Detected is on by default at critical severity, because an open relay gets abused and blocklisted fast. ### Response Time Tracking DNS, connect, banner and EHLO times are stored on every check, and the SMTP Connect Time rule alerts when connecting to your server gets slow. ### Reverse DNS & Banner Checks Optional rules flag a failed forward-confirmed reverse DNS (PTR) lookup, which many receiving servers hold against you, and a banner that doesn't name the host you connected to. ### Multi-Location Confirmation Failures are confirmed from several locations before an incident opens, so a single bad network path never pages you with a false alarm. ### Authenticated Submission Check Turn on Authenticate and the check logs in on 587 (STARTTLS) or 465 (implicit TLS) with the account your apps send from, after TLS is up, and reads the certificate's validity and days left. It never logs in on port 25. Banner checks work on 25, 587, 465 or any custom port. ### Historical Trends Connect time with minimum, average and maximum, uptime from confirmed incidents, and weekly uptime reports by email, for spotting slow regressions. ## A closer look Open relay and missing STARTTLS are separate rules with their own severity. Each check keeps the server banner and the TLS and open relay results. ## Why Choose Our SMTP Monitoring Solution? When email silently stops flowing, you usually find out from an angry customer rather than a dashboard. Our SMTP monitoring talks to your mail servers the way a sending server would: it reads the banner, sends EHLO, checks that STARTTLS is offered and tests for an open relay, without ever sending a message. Failures are confirmed from several locations before anyone is paged. Add a login and it also checks what your apps depend on: TLS, the certificate and SMTP authentication on the submission port. To prove a message actually arrives, pair it with an email round-trip monitor. [Start monitoring now](/auth/sign-up) Check that outbound and inbound mail servers answer like mail servers Banner and EHLO exchange, not just a port check STARTTLS recorded on every check, with an optional TLS Required rule Open relay test on by default, without sending mail Optional reverse DNS (FCrDNS) and banner hostname rules Failures confirmed from several locations DNS, connect, banner and EHLO timings on every check Optional login check on 587 or 465, with certificate expiry Alerts on any of 16 channels, including email, Slack and PagerDuty ## How SMTP Monitoring Works From mail host to alert in four steps 1 ### Add Your Mail Server Enter your mail server's host name, such as mail.example.com, and port, and choose the regions you want to connect from. 2 ### Choose Your Rules Open Relay Detected is on by default, and Login Failed and Certificate Expiry when you add a login. Turn on TLS Required, a connect time limit, reverse DNS or the banner check, and set how many failed checks confirm an outage. 3 ### Monitor 24/7 At your interval, a probe connects, reads the banner, sends EHLO, runs the relay test and, with a login, completes TLS and authenticates, then ends with QUIT. No message is ever sent. 4 ### Get Alerts When the server stops answering, stops offering STARTTLS, accepts mail for strangers or rejects your login, you're notified on your channels with the error from the failed checks. ## SMTP Monitoring Use Cases For any mail server that has to keep answering ### Transactional Email Servers Password resets, receipts and confirmations all depend on your SMTP server answering. Know soon after it stops responding, long before customers report missing emails. ### Open Relay Protection A relay left open by a config change gets found and abused for spam, and your IP ends up on blocklists. The relay test runs on every check, and a blacklist monitor on the same IP watches the lists themselves. ### Inbound Mail Gateways The hosts your MX records point to must keep accepting connections to receive customer email. Add a monitor for each one to confirm it answers from the outside. ### Self-Hosted Mail Infrastructure Running your own Postfix, Exim or Microsoft Exchange stack means you own its uptime. SMTP checks catch a hung daemon, missing STARTTLS or an open relay, and the login check covers authentication and the certificate on the submission port. ## Frequently asked questions Everything you need to know about SMTP monitoring [All questions→](/faq)[Ask us directly](/contact) What is SMTP monitoring? SMTP monitoring connects to your mail server on a schedule and talks to it the way a sending server would. Each check reads the greeting banner, sends EHLO, notes whether STARTTLS is offered, tests whether the server relays mail for strangers and can check its reverse DNS. You get an alert when the server stops answering or one of those checks fails. How does SMTP monitoring work? Why isn't a simple port check enough? What is STARTTLS and why do you check it? Does it check the mail server's TLS certificate? Which SMTP ports can I monitor? Can it check that SMTP authentication still works? Does the SMTP monitor send a test email? Does it test whether my server is an open relay? Which plans include SMTP monitoring? What happens when a check fails? Can I monitor internal or private mail servers? ## From our blog Guides, deep-dives, and best practices from the WatchFor team [Email ### SMTP monitoring: is your mail server still accepting and sending mail? Oct 05, 2026·5 min readRead article](/blog/smtp-monitoring-explained)[Guides ### Will our new mail server accept mail? How to test it with the SMTP Server Test Oct 04, 2026·6 min readRead article](/blog/how-to-test-an-smtp-server)[Email ### How to test email delivery end to end (and keep testing it) Oct 05, 2026·5 min readRead article](/blog/how-to-test-email-delivery) ## Ready to Start Monitoring Your Mail Servers with SMTP Checks? SMTP monitors are on the Pro and Business plans. Run the free SMTP server test first, or sign up for free and upgrade when you add your first mail server. IMAP, POP3 and email round-trip monitors cover the receiving side. [Get started for free](/auth/sign-up)[View documentation](/docs/monitors/email#smtp) --- Canonical page: https://watchfor.io/smtp-monitoring · Site guide: https://watchfor.io/llms.txt