Live · STARTTLS + certificate check

SMTP TLS Test

NOC Operator Toolkit

Enter an email address or a domain. We find its mail servers, hold a real SMTP conversation with each one, check whether TLS and the certificate hold up, and hand you the whole transaction.

Test a mail server

One field is all you need. An address is tested against the MX servers for its domain.

Examples: gmail.com outlook.com postmaster@icloud.com
One test every 10 seconds.

How this test works

What the columns mean, and what this tool deliberately does not do.

What are the test steps?
Answer is the TCP connection, Connect the SMTP greeting, HELO the EHLO exchange, TLS whether STARTTLS is offered and accepted, Secure the TLS handshake itself (version, cipher and forward secrecy), Cert whether the certificate chains to a trusted root and matches the server name, and From whether the server accepts a sender. The score is out of 100, weighted towards the TLS and certificate results.
Does this send an email?
No. The conversation stops after MAIL FROM: no recipient is ever given, no message body is ever sent, and the session ends with QUIT.
What is FCrDNS?
Forward-confirmed reverse DNS: the server address has a PTR record, and the name in it resolves back to that same address. Receiving mail servers often check it before accepting mail. We report it, but it is not part of the score.
Which port should I pick?
Port 25 carries server-to-server mail and 587 is submission; both open in the clear and upgrade with STARTTLS. Port 465 is usually wrapped in TLS from the first byte, so both forms are offered: 465 - SMTPS for that, or 465 - STARTTLS for a server that expects the upgrade on 465 instead.
Which TLS versions does the test accept?
The client requires TLS 1.2 or better. A server that only offers TLS 1.0 or 1.1 will fail at the handshake, which is the result you want to know about anyway.