SMTP TLS Test
Enter an email address or a domain. We find its mail servers, hold a real SMTP conversation with each one, check whether TLS and the certificate hold up, and hand you the whole transaction.
Live Test
Test SMTP
One field is all you need. If a domain or email is provided, we’ll perform an MX lookup and test against that. If no MX record is found, we’ll try the A record if possible.
Notes
How this test works
What the columns mean, and what this tool deliberately does not do.
What are the test steps?
Answer is the TCP connection, Connect the SMTP greeting,
HELO the EHLO exchange, TLS whether STARTTLS is offered and accepted,
Secure the TLS handshake itself (version, cipher and forward secrecy),
Cert whether the certificate chains to a trusted root and matches the server name,
and From whether the server accepts a sender. The score is out of 100, weighted
toward the TLS and certificate results.
Does this send an email?
No. The conversation stops after
MAIL FROM: no recipient is ever given, no message
body is ever sent, and the session ends with QUIT.
What is FCrDNS?
Forward-confirmed reverse DNS: the server address has a PTR record, and the name in it resolves
back to that same address. Receiving mail servers often check it before accepting mail. We
report it, but it is not part of the score.
Which port should I pick?
Port
25 carries server-to-server mail and 587 is submission; both open
in the clear and upgrade with STARTTLS. Port 465 is usually wrapped in
TLS from the first byte, so both forms are offered: 465 - SMTPS for that, or
465 - STARTTLS for a server that expects the upgrade on 465 instead.
Which TLS versions does the test accept?
The client requires TLS 1.2 or better. A server that only offers TLS 1.0 or 1.1 will fail at the
handshake, which is the result you want to know about anyway.