SMTP diagnostics

This test opens a real SMTP conversation and shows you every line of it. Reading the transcript tells you far more than a pass or fail badge, because it shows exactly which step the server stopped at.

• The banner is the first line the server sends, starting with 220. Getting this far means DNS resolved, the port is open, and something is listening. If the test fails before this, the problem is network level, not mail level.
• EHLO extensions are what the server says it supports. STARTTLS means it can upgrade the connection to encrypted, AUTH lists the login mechanisms it accepts, and SIZE is the largest message it will take.
• Reply codes follow a pattern. 2xx is success, 3xx means the server wants more input, 4xx is a temporary failure worth retrying, and 5xx is permanent. The difference between 4xx and 5xx matters: a 4xx will resolve itself on retry, a 5xx never will.
• No STARTTLS on port 587 means credentials would travel in the clear. Treat that as a configuration fault rather than a quirk.

The three mail ports do different jobs and are not interchangeable.

• Port 25 is server to server delivery. Almost every residential and cloud provider blocks outbound 25, so a failure here from your own machine usually means your network blocked it rather than the mail server being down.
• Port 587 is submission, which is what an application or mail client should use to send. It expects STARTTLS and authentication.
• Port 465 is implicit TLS submission. The connection is encrypted from the first byte rather than upgraded mid-session.

If your application cannot send mail, testing 587 against your provider is the fastest way to separate a credentials problem from a network problem.

• Connection times out. A firewall is dropping the packets, or the provider blocks that port outbound. A refused connection is different and means nothing is listening.
• Banner arrives, then everything fails. The server is up but is rejecting you, commonly because the connecting IP has a poor reputation or no reverse DNS.
• 535 authentication failed. The credentials are wrong, or the provider requires an app specific password rather than the account password.
• 550 relay denied. The server will not send on your behalf. Either authentication was skipped or the recipient domain is not one it handles.
• Everything passes but mail still does not arrive. Delivery is a separate problem from connection. Check authentication records and blacklists next.