Free tool · Test
SMTP tester
Enter your mail server's host and port to test the connection, the greeting, the extensions it offers, STARTTLS or SSL/TLS with its certificate, and your login. Every step shows the server's reply, how long it took and what to fix if it failed.
What does an SMTP tester check?
It connects to your SMTP server from the internet and runs the same conversation a mail client or app does: open the connection, read the 220 greeting, send EHLO, upgrade with STARTTLS (or start with TLS on port 465), check the certificate, and log in with AUTH. If every step passes, an app pointed at the same settings will connect too.
Once login works you can send one test email through your server to an address you own, to check delivery end to end. Your password is used for that one test and never stored or logged.
How to read your results
- Pass
- That step worked. When every step passes, use the same host, port, encryption and login in your app.
- Connect: timed out
- Nothing answered on that port. A firewall is dropping the traffic, or the server doesn't listen there. If your app can't reach port 25 either, that's normal: most cloud hosts block outbound 25, so apps send on 587 or 465. See troubleshooting.
- Connect: refused
- The host is up but nothing listens on that port. Check the port against your provider's settings page.
- TLS: plain text, not TLS
- SSL/TLS was chosen for a port that starts in plain text (usually 587). Switch encryption to STARTTLS. On port 465 it's the other way round: choose SSL/TLS. See STARTTLS vs implicit TLS.
- Certificate problem
- The certificate has expired, is self-signed, is missing its intermediate, or is for a different name. Clients will refuse it, so the tester stops before sending your password.
- 535 authentication failed
- The server rejected the username or password. Re-copy both, and use an app password or SMTP credential if the account has two-factor sign-in.
- 530 must issue STARTTLS
- The server wants encryption or a login first. Use STARTTLS (or SSL/TLS on 465) and enter your credentials. Related: 554 5.7.1 relay access denied.
- Skipped
- Not tested: no credentials were entered, or the tester won't send a password over a connection that isn't encrypted with a valid certificate.
What the SMTP tester checks, step by step
Connect: a TCP connection to the host and port. Fails on a wrong port, a firewall, or a host that doesn't run a mail server.
Greeting: the 220 line the server sends first. On port 465 the TLS handshake comes before it.
EHLO: the extensions the server advertises, such as STARTTLS, AUTH PLAIN LOGIN, SIZE and PIPELINING. Many servers only list AUTH after the TLS upgrade.
STARTTLS or SSL/TLS: the TLS version and cipher, and the certificate's name, issuer and expiry date. The certificate has to match the hostname you typed and chain to a public certificate authority.
Authentication: a login with AUTH PLAIN or AUTH LOGIN. The result is pass or fail; the transcript shows *** in place of your credentials.
Test email (optional): one message with a fixed subject and body, through your server and your login, to one address you confirm is yours.
How to read the transcript
Lines marked C: are what the tester sent and S: what your server replied, with the time since the connection opened. Replies starting with 2 or 3 mean go ahead, 4 means try again later, and 5 means a permanent error. The SMTP error codes reference explains the common ones.
Copy the transcript into a support ticket with your provider: it shows exactly where the session stopped.
Ports and encryption
Use 587 with STARTTLS for apps and mail clients, or 465 with SSL/TLS if your provider offers it. 2525 is an unofficial fallback some providers accept, and 25 is for mail servers delivering to each other. Most SSL errors come from a mismatch between the port and the encryption setting. SMTP ports explained covers each one.
Safe to use with real credentials
Your username and password are used once, for this test, and never stored or written to logs. They're only sent after the server's certificate has been verified, never over plain text, and the transcript shows *** instead. The tester only connects to public mail servers on ports 25, 465, 587 and 2525, and runs are rate-limited per visitor.
Test Groundmail's SMTP relay
Press Test Groundmail's SMTP above to fill in smtp.groundmail.dev, port 587 and STARTTLS, then add an SMTP credential from the dashboard to check your login.
Need an SMTP server that just works?
Groundmail's SMTP relay is smtp.groundmail.dev on port 587 with STARTTLS, username groundmail and an SMTP credential as the password. Mail goes out from our own mail servers and IP space, with the same domains, suppressions and webhooks as the API. Free for 3,000 emails a month.
Questions
How do I test an SMTP server?
Enter the host, port and encryption your provider gives you, plus your username and password if you want to check login, and run the test. It connects, reads the greeting, lists the server's extensions, upgrades to TLS, checks the certificate and logs in, showing each reply. From a terminal, openssl s_client -starttls smtp -connect host:587 does the same by hand.
Is it safe to enter my SMTP password?
Your password is used for this one test and then discarded. It's never stored, logged or shown in the transcript, and it's only sent over TLS after the server's certificate checks out. If you'd rather not enter it, run the test without credentials: everything up to login is still checked.
Why does port 25 time out from my server?
Most cloud providers and home ISPs block outbound port 25 to stop spam, so an app on AWS, Google Cloud, Azure or DigitalOcean usually can't connect on 25 even when the mail server is fine. If this tester connects on 25 but your app can't, your host is blocking it. Port 25 is for mail servers delivering to each other; apps should send on 587 or 465.
What's the difference between STARTTLS and SSL/TLS?
STARTTLS (ports 587, 25 and usually 2525) starts in plain text and upgrades to TLS after EHLO. SSL/TLS, also called implicit TLS (port 465), starts the TLS handshake before any SMTP. Both are secure when TLS is required; the setting just has to match the port.
Can I send a test email?
Yes. Once login passes, enter a From address your login may send as and one recipient that's yours. The message has a fixed subject and body ("SMTP test from groundmail.dev/tools/smtp-tester") and goes through your own server. You can send 3 an hour.
What does 535 authentication failed mean?
The server rejected the username or password. Check for spaces at either end, make sure SMTP is enabled for the account, and use an app password or an SMTP credential if the account has two-factor sign-in. On Groundmail the username is always groundmail and the password is an SMTP credential that starts with gmsmtp_.
Why can't I test my server on a private IP?
The tester connects from the internet, so it only reaches public addresses. Private, internal and reserved ranges (like 10.x, 192.168.x and 127.0.0.1) are refused. Test the public hostname your app uses.