What does the SMTP server test check?

It resolves the MX records for the domain, opens a session with the primary mail host on port 25, and records the SMTP banner, the EHLO capabilities, whether STARTTLS is offered and what certificate is presented. It also probes the postmaster and abuse addresses and, when enabled, tests for an open relay. No message is ever sent.

STARTTLS is an SMTP command that upgrades a plaintext connection to TLS. The server advertises it in the EHLO response and the sender may take it up. It is opportunistic: a sender that finds no STARTTLS offer delivers in the clear rather than failing, so its absence causes no error anyone will see.

Is an expired certificate on a mail server a problem?

It should be fixed, but it rarely blocks mail. Because most senders do not verify the certificate on an opportunistic TLS connection, an expired or mismatched one still encrypts the session and delivery continues. It becomes a hard failure once MTA-STS or DANE is in force, and it is always a sign the host needs attention.

What is an open relay, and how would I know I had one?

An open relay accepts mail from any sender for any recipient, rather than only for its own domains or authenticated users. It will be found by automated scanning and used to send spam, and the address will be blocklisted quickly. The relay probe answers the question directly by offering a third-party recipient and reading the response code.

Why does the connection time out?

Most often a firewall is dropping packets on port 25 rather than refusing them, which produces a hang rather than an error. Outbound port 25 is also blocked by default on many hosting networks. A very slow but successful banner is different: it is usually a deliberate delay applied to catch misbehaving senders.

SMTP server test: banner, STARTTLS, certificate

What the SMTP server test does, line by line

The test connects on port 25, waits for the banner, sends EHLO and reads the capabilities the server advertises. If STARTTLS is offered it negotiates it and reads the certificate the server presents. It measures how long the connection and the banner took, because a slow greeting is often the first sign of a host under load or applying a delay deliberately.

Nothing is ever sent. The session ends with QUIT, and DATA is not issued at any point.

An abridged transcript. EHLO is repeated after STARTTLS because the capability list is renegotiated inside the encrypted session.

220 mx1.example.net ESMTP ready
EHLO probe.example.org
250-mx1.example.net
250-PIPELINING
250-SIZE 36700160
250-STARTTLS
250 8BITMIME
STARTTLS
220 2.0.0 Ready to start TLS
EHLO probe.example.org
250-mx1.example.net
250 8BITMIME
QUIT
221 2.0.0 Bye

STARTTLS and the certificate a mail host offers

TLS between mail servers is opportunistic. STARTTLS is an offer in the EHLO response, and a sender that does not see it delivers in the clear rather than refusing. This is why a mail host with no STARTTLS does not visibly fail: the mail arrives, unencrypted, and nobody is told.

For the same reason, an expired TLS certificate or one that does not match the MX hostname rarely blocks delivery either, because most senders do not verify it. The mechanisms that make verification mandatory are MTA-STS, which publishes a policy over HTTPS, and DANE, which pins the certificate in DNSSEC-signed records. Until one of those is in place, the certificate is a signal about how the host is maintained rather than a control.

The open relay probe

An open relay is a mail server that accepts mail from anyone for anyone, which is to say a server that will be found and used for spam within days of being exposed. The probe offers an envelope sender and a third-party recipient and reads the response code, then finishes with RSET and QUIT. It never issues DATA and never transmits a message, so a host that answers correctly is put to no inconvenience.

The probe is enabled by default and a deployment can switch it off, since some networks would rather no relay test ran against their hosts at all.

Slow banners, greylisting and timeouts

A connection that hangs is more often a firewall dropping packets silently than a mail server that is down; a refused connection at least answers. A banner that takes many seconds to arrive is usually deliberate, since delaying the greeting catches software that starts talking before it is spoken to.

Greylisting shows up as a temporary rejection on an early attempt and a clean acceptance a few minutes later. It is normal, it delays first messages from a new sender, and it is not a fault to fix on the receiving side.

Role addresses: postmaster and abuse

RFC 5321 requires every domain that receives mail to accept mail for postmaster, and RFC 2142 asks for abuse as well. Both are how a receiver, a blocklist operator or another administrator reaches you when something is wrong with your mail — and a domain that bounces them has removed its own route back.

The test checks whether each address is accepted, using the same read-only session, without sending anything to either.

Run this check on your own domain. A workspace takes a minute to create and runs every one of the eleven checks against the domain you name.

Check my domain

Common questions

What does the SMTP server test check?: It resolves the MX records for the domain, opens a session with the primary mail host on port 25, and records the SMTP banner, the EHLO capabilities, whether STARTTLS is offered and what certificate is presented. It also probes the postmaster and abuse addresses and, when enabled, tests for an open relay. No message is ever sent.
What is STARTTLS?: STARTTLS is an SMTP command that upgrades a plaintext connection to TLS. The server advertises it in the EHLO response and the sender may take it up. It is opportunistic: a sender that finds no STARTTLS offer delivers in the clear rather than failing, so its absence causes no error anyone will see.
Is an expired certificate on a mail server a problem?: It should be fixed, but it rarely blocks mail. Because most senders do not verify the certificate on an opportunistic TLS connection, an expired or mismatched one still encrypts the session and delivery continues. It becomes a hard failure once MTA-STS or DANE is in force, and it is always a sign the host needs attention.
What is an open relay, and how would I know I had one?: An open relay accepts mail from any sender for any recipient, rather than only for its own domains or authenticated users. It will be found by automated scanning and used to send spam, and the address will be blocklisted quickly. The relay probe answers the question directly by offering a third-party recipient and reading the response code.
Why does the connection time out?: Most often a firewall is dropping packets on port 25 rather than refusing them, which produces a hang rather than an error. Outbound port 25 is also blocked by default on many hosting networks. A very slow but successful banner is different: it is usually a deliberate delay applied to catch misbehaving senders.

Keep reading

Related checks, definitions and guides.

Hold a live SMTP session with a mail host