SMTP Test

Our SMTP test looks up the MX records of the domain, sorts them by priority, and holds a short read-only conversation with every host, reporting each step so you can see where a failing server stops answering.

1. Connect. A TCP connection to the host on port 25, with the time it took to open.
2. Banner. The 220 greeting the server sends first. It usually names the server and the software, and a server that takes seconds to send it is applying a deliberate delay.
3. EHLO. The extended hello. The server answers with the extensions it supports, such as SIZE, PIPELINING, 8BITMIME and STARTTLS. If EHLO is rejected the test falls back to HELO, which is a sign of a very old or misconfigured server.
4. STARTTLS. If the server advertised it, the test upgrades the connection to TLS and records the protocol version, the cipher suite and the certificate, including whether the name on it matches the MX hostname and whether it chains to a trusted root.
5. MAIL FROM and RCPT TO. The test names a sender at dnsx.dev and then a recipient at example.com, a domain no mail server should relay for. The response code to RCPT TO is the open relay verdict.
6. RSET and QUIT. The transaction is reset and the connection closed.

The DATA command is never sent, so no message exists at any point. Alongside the conversation, our tool looks up the PTR record for the IP it connected to and checks whether it matches the MX hostname, because a mismatch there is one of the most common reasons receiving servers score a host badly.

Port 25 is where mail servers talk to each other. When Gmail delivers a message to your domain, it connects to your MX host on port 25 and nothing else, so it is the only port that tells you whether inbound mail works. Ports 587 and 465 are submission ports for mail clients that authenticate with a username and password. They can be open while port 25 is blocked, and mail from the outside world will still fail.

Our tool deliberately has no port parameter. A public service that connects to any port a visitor names is a port scanner running from our IP address, and we do not want to run one. The ports it probes are fixed in the backend.

RFC 5321 section 5.1 says that a domain with no MX record is treated as though it had one pointing at itself with preference 0. This is called implicit MX. Sending servers look up the A or AAAA record of the domain and deliver to that address on port 25. Our SMTP test does the same, and marks the result so you know the domain is relying on the fallback rather than a published record.

Implicit MX is fragile. Most web servers do not listen on port 25, so mail to such a domain is retried for days and then bounced. A domain that should not receive mail at all is better served by a null MX record (RFC 7505), which makes senders fail immediately.

• Connection refused or timed out. Nothing is listening on port 25, or a firewall is dropping the packets. Many cloud providers, including AWS, Google Cloud and Azure, block outbound port 25 by default, and some block inbound as well until you ask. This is the failure that DNS alone can never show you.
• Slow banner. The connection opens but the 220 greeting arrives seconds later. Servers do this on purpose to catch spam software that sends before the greeting. It is not a fault, but a banner delay longer than about thirty seconds will cause some senders to give up.
• Greylisting. The server answers 450 or 451 to MAIL FROM or RCPT TO on first contact and expects the sender to retry later. Our relay probe reports this as inconclusive, because the server has not said whether it would relay.
• No STARTTLS. The EHLO response does not list STARTTLS, so mail arrives in cleartext. It still delivers, but Google marks it as unencrypted and senders with an enforced TLS policy will not deliver at all.
• STARTTLS offered but the handshake fails. Usually an expired certificate, a certificate for the wrong name, or a server that only supports protocol versions a modern client refuses. Senders that require TLS will defer.
• PTR mismatch. The reverse DNS of the IP names a different host from the MX record. It is normal for large providers, where one address serves many hostnames, and a scoring signal for a small self-hosted server.

Find the MX host with nslookup or Resolve-DnsName, then use Test-NetConnection with -Port 25 to confirm the host accepts a TCP connection. Windows has no built-in STARTTLS client, so Test-NetConnection only proves the port is open and cannot show the banner, the EHLO reply or the certificate. For those, install OpenSSL (Git for Windows ships one) and run the openssl command from the Linux section, or use our SMTP test above.

nslookup -type=MX example.com
Resolve-DnsName -Type MX example.com
Test-NetConnection mail.example.com -Port 25

macOS ships dig and nc, so no install is needed. Find the MX host with dig, then use nc to confirm port 25 is open and read the banner. macOS also ships an openssl command (LibreSSL) that accepts the same -starttls smtp session shown in the Linux section.

$ dig MX example.com +short
10 mail.example.com.

$ nc -v mail.example.com 25
Connection to mail.example.com port 25 [tcp/smtp] succeeded!
220 mail.example.com ESMTP

The openssl command line client can open a port 25 session, issue STARTTLS for you and then hand you the encrypted session to type into. Find the MX host first with dig, then connect. The lines starting with a number are what the server sends back.

$ dig MX example.com +short
10 mail.example.com.

$ openssl s_client -starttls smtp -connect mail.example.com:25 -crlf
...certificate chain and TLS details...
250 SMTPUTF8
EHLO test.local
250-mail.example.com
250-SIZE 52428800
250-PIPELINING
250 8BITMIME
MAIL FROM:<[email protected]>
250 2.1.0 Ok
RCPT TO:<[email protected]>
554 5.7.1 <[email protected]>: Relay access denied
QUIT
221 2.0.0 Bye

The 554 on RCPT TO is what you want to see. A 250 there means the server accepted a recipient at a domain it does not handle. Plain telnet to port 25 shows the banner and the EHLO response, but cannot upgrade to TLS.

The conversation our tool holds is the same one every sending mail server holds many times a day, and it sends no message. Even so, repeated probes against servers you do not run are unwelcome, and some operators block sources that probe for open relays. Test domains you administer, or domains whose owners have asked you to look at their mail setup. Results are cached for five minutes, so repeating a test returns the same report without a new connection.