Skip to content
IPeek

SMTP Test

Connect to a mail server and check STARTTLS

Checking…

What is an SMTP test?

This SMTP test resolves a domain's primary MX, opens a connection on port 25, reads the greeting banner and the EHLO capability list, and reports whether the server offers STARTTLS for encrypted delivery. It is a quick way to confirm a mail server is reachable and TLS-capable.

How the SMTP handshake and EHLO work

When you submit a domain, IPeek looks up its MX records, picks the highest-priority host, and opens a TCP connection on port 25. The server answers with a 220 greeting banner that names the software, usually Postfix, Exim, or Microsoft. IPeek then sends EHLO and parses the multi-line 250 response listing supported extensions. Look for STARTTLS in that list: it signals the server can upgrade the plaintext session to an encrypted TLS channel before any mail data is exchanged. SIZE, PIPELINING, and 8BITMIME commonly appear alongside it.

How to read your SMTP test results

Start with the banner. A 220 response means the server accepted the connection and is ready. If STARTTLS appears in the EHLO capability list, the server can encrypt inbound delivery; its absence means mail may be relayed in cleartext. A timeout or refused connection usually points to a firewall, a wrong MX target, or a host that is down. Note that port 25 is for server-to-server delivery, not client submission, which uses 587 or 465. The banner hostname should match your PTR record to satisfy receivers that check it.

Common SMTP problems and how to fix them

Connection refused or timed out is the most frequent failure, typically a firewall blocking port 25 or an MX record pointing at the wrong host. A missing STARTTLS line means the receiving server cannot negotiate TLS, so add a certificate and enable it in your MTA. A self-signed or expired certificate still advertises STARTTLS but breaks strict TLS policies like MTA-STS and DANE. If the banner reports a generic hostname that differs from your reverse DNS, fix the PTR record, because many receivers reject mail when the banner and PTR disagree.

Frequently asked questions

What port does SMTP use for mail delivery?

Server-to-server mail delivery uses port 25, which is what this test connects to. Ports 587 and 465 are reserved for mail submission from clients and applications, with 587 using STARTTLS and 465 using implicit TLS. IPeek checks port 25 because that is where receiving MX servers accept inbound mail from the internet.

What does STARTTLS do in SMTP?

STARTTLS upgrades a plaintext SMTP session to an encrypted TLS connection. The server advertises STARTTLS in its EHLO response, and the sending server issues the command to negotiate TLS before transmitting any message data. Without it, mail crosses the network in cleartext and can be read or altered in transit. STARTTLS is opportunistic unless enforced by MTA-STS or DANE.

Why is my SMTP connection timing out?

A timeout almost always means a firewall is blocking port 25 or the MX record points to a host that is down or unreachable. Many residential and cloud networks block outbound port 25 by default. Confirm the MX target resolves correctly, check that the mail server is listening, and verify no security group or firewall rule is dropping the connection.

Does a missing STARTTLS mean my email is insecure?

It means inbound mail to that server can be delivered without encryption, exposing it to interception on the wire. Most modern receivers still accept the mail, but they cannot encrypt the session. To fix it, install a valid TLS certificate and enable STARTTLS in your MTA configuration, then re-run the test to confirm the capability now appears.

What is the SMTP greeting banner?

The greeting banner is the first line a mail server sends after you connect, beginning with response code 220. It identifies the server software and hostname and confirms the server is ready to accept commands. Receivers often compare the banner hostname against the connecting IP's PTR record, so a mismatch can trigger spam filtering or outright rejection.