--- title: Free SMTP Server Test description: Connect to any mail server on port 25, 465 or 587 from a real probe location and see what a sending server sees — the banner, whether STARTTLS is offered, whether reverse DNS matches, and whether it relays for strangers. Verify a new mail host before you route production mail through it. canonical: https://watchfor.io/smtp-test --- [Back to all free tools](/free-tools) # SMTP Server Test Connect to any mail server on port 25, 465 or 587 from a real probe location and see what a sending server sees — the banner, whether STARTTLS is offered, whether reverse DNS matches, and whether it relays for strangers. Verify a new mail host before you route production mail through it. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is SMTP Server Test ? Before any email is delivered, two mail servers have a short conversation over SMTP: a greeting banner, an EHLO that lists what the receiver supports, ideally a STARTTLS to encrypt the rest, then the envelope. Whether that conversation goes well is decided by things you can't see from a mail client — is port 25 reachable at all, does the banner make sense, is STARTTLS offered, does the server's reverse DNS check out, and will it relay mail for anyone who asks (which gets it blocklisted within hours). This test opens a real SMTP session with any mail server from a probe location of your choice, on port 25, 465 (implicit TLS) or 587 (submission), and reports what a sending server would see: the banner, STARTTLS support, forward-confirmed reverse DNS, and an open-relay probe that tries to hand it mail for an outside domain. Use it on a new mail host before routing production mail through it, and on a partner's when their mail isn't arriving. ## How it works A real, polite SMTP session — nothing is sent: - 1 Resolve and connect — The hostname is resolved, private addresses are refused, and a TCP connection is opened on the chosen port. Port 465 is wrapped in TLS from the first byte; 25 and 587 start in plain text. - 2 Banner and EHLO — The server's 220 greeting is read and compared with the hostname; EHLO is sent and the extensions the server advertises are read — STARTTLS being the one that matters. - 3 Reverse DNS — The connected IP's PTR is looked up and resolved forward again. A match is forward-confirmed reverse DNS, which most receivers require of a sender. - 4 Relay probe — MAIL FROM a WatchFor address, RCPT TO an address at a domain the server doesn't host. A 250 accepting it means the server relays for strangers — an open relay. Then QUIT . No message data is ever sent. Every step is timed, so a server that's reachable but takes eight seconds to greet (tarpitting, or a struggling host) shows up as such. ## When you'd use it ### Bringing up a new mail server Postfix installed, DNS set. Before the first real message: can the world reach port 25, does the banner name the host, is STARTTLS on, does the PTR match, is relaying denied? Five answers in one run. ### Mail to a partner bounces or never arrives Find their MX with the MX lookup, then test the host. A closed port, a 421 banner, or a server that greets and hangs explains the bounce better than any log line on your side. ### Provider or firewall says port 25 is blocked Most cloud providers block outbound 25 by default; many networks block inbound. Test from several probe locations to see whether the block is on the server's side or the network between. ### Confirming the relay is closed After changing mynetworks , relay_domains or the authentication setup, prove the server refuses RCPT TO for outside domains. An open relay is the fastest route onto every blocklist. ## Reading the result ### Banner 220 mail.example.com ESMTP Postfix — the server's name and, often, software. A banner that names a different host is normal behind a load balancer; a 4xx banner means the server is refusing connections right now. ### STARTTLS / encryption On 25 and 587, STARTTLS in the EHLO response means the session can be upgraded. On 465 the whole session is already encrypted. No STARTTLS on 25 means mail to this host travels in the clear and Gmail marks it as such. ### Reverse DNS Matches: the IP's PTR resolves back to the same IP. Mismatch or missing: many receivers will greylist, score as spam or reject outright. ### Relay Denied: the server refused to accept mail for an outside domain — correct. Open relay: it accepted; fix it today. ## Check it yourself openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com