SMTP Test Tool
Test any SMTP server's connection, authentication, TLS/SSL setting, and delivery. Diagnose connection refused, authentication failures, TLS errors, and relay errors before they reach production — without firing up Telnet or a test mail client.
SMTP Configuration
Privacy Note: Your credentials are sent to Toolsana's server to run the test and are not stored. Always use secure connections (TLS/STARTTLS) when testing with production credentials.
Test Results
Test results will appear here
Configure your SMTP settings and click a test button to start
About SMTP Testing
Port 587 (STARTTLS): Recommended for most modern SMTP servers. Starts unencrypted and upgrades to TLS.
Port 465 (SSL/TLS): Direct encrypted connection from the start. Used by some providers.
Port 25: Traditional SMTP port, typically unencrypted. Often blocked by ISPs for security.
Test Connection: Verifies server connectivity and authentication without sending email.
Send Test Email: Performs full test including actual email delivery.
Security: Always use TLS/STARTTLS for production servers to protect credentials.
About SMTP Test Tool
The SMTP Test Tool exercises an SMTP server through a real connection: TCP handshake, optional STARTTLS upgrade or implicit TLS, EHLO, AUTH, and (optionally) full message delivery. It reports whether the connection, authentication, and send steps succeeded, along with the server's response text and any warnings — a quick pass/fail diagnostic presented as a clean form. It does not show the full SMTP transcript. Pairs with SPF Checker, MX Lookup, and Trace Email for end-to-end deliverability debugging.
Why use a SMTP Test Tool?
When transactional mail starts bouncing, the 'why' is almost always one of four things: TCP connection refused, TLS negotiation failure, AUTH rejected, or RCPT TO refused. Telnet can show you each of those but only if you remember the SMTP protocol commands and TLS handshake sequence. This tool runs the same kind of diagnostic via a UI — type credentials, click test, see whether connection, authentication, or sending failed and the server's response message. No need to install Postfix or write a one-off Node script.
Who is it for?
DevOps engineers configuring transactional email for a new app, developers integrating SendGrid/Mailgun/Postmark/SES SMTP relays, IT admins testing an on-prem mail server before cutover, support teams diagnosing 'our outbound mail stopped working' tickets, and security folks validating that a vendor's SMTP credentials work without bouncing the test mail through their own production app.
How to use the tool
Enter the SMTP host (smtp.gmail.com, smtp.sendgrid.net, your own server, etc.)
Pick the port — 587 for STARTTLS (most common), 465 for implicit TLS, 25 for unencrypted (testing only), or 2525 (alternative); no other ports are allowed
Choose the security mode — auto-defaults match the port choice
Enter the username and password (or app password). They are sent to Toolsana's server to run the test and are not stored
Set the From and To addresses for the test message
Click 'Test Connection' for a non-sending diagnostic OR 'Send Test Email' for full delivery (send requires a username and password)
Read the result panel: connection, authentication, and send status show pass/fail, with the server's response text and any warnings
If it fails, the server's response (e.g. 535 for auth failure, 550 for relay denied, 4xx for transient) points to what to fix
Key Features
Step status and server response
Shows whether the connection, authentication, and send steps succeeded, plus the server's response text when one is returned. The full command-by-command transcript is not shown.
TLS / STARTTLS check
Shows whether TLS is enabled and which mode was used (STARTTLS or implicit TLS). STARTTLS is required when selected, so a server that can't upgrade fails the test. TLS version, cipher, and certificate details are not reported.
Auto-port → security mapping
Pick port 587 → STARTTLS. Pick 465 → implicit TLS. Pick 25 → unencrypted. The form pre-selects the right mode so you don't fight protocol mismatches.
Test without sending
'Test Connection' connects (and authenticates if you entered credentials) without sending any message — useful for confirming a setup before delivering mail. Without credentials it only checks the connection.
Full-delivery test with actual sent message
'Send Test Email' delivers a real test message from the From address to the To address and shows the server's final response line. The subject and body are fixed.
Error reporting
Failures are labelled as connection/TLS, authentication, or envelope/message errors, with the server's actual message. A warning explains the app-password requirement for Gmail and Microsoft hosts.
No credential storage
Username and password are sent to Toolsana's server only to run the test and are not stored. Use app-specific passwords (Gmail, Microsoft) for extra safety.
Common Use Cases
Verifying SendGrid / Mailgun / Postmark API SMTP credentials
Scenario: You provisioned an ESP API key and want to make sure the SMTP relay credentials work before wiring them into production.
✓ 30-second test confirms the relay accepts your credentials and delivers mail. Skip the round-trip of deploying a code change just to test.
Debugging 'our app stopped sending email overnight'
Scenario: App deploys haven't changed but transactional mail is failing. Suspect the SMTP relay credentials expired or the provider rotated something.
✓ Run the test with the production credentials. If AUTH fails, you know it's a credential / API-key issue. If TLS fails, the provider may have raised minimum TLS version. If 5xx on RCPT, the recipient is on a suppression list.
Pre-launch validation of an in-house Postfix / Exim setup
Scenario: You set up your own mail server and want to confirm everything works (TLS, AUTH, relay) before pointing the app at it.
✓ Test against your own server. Catches the misconfigured TLS cert, wrong relay rules, or AUTH backend issues before users hit them.
Migrating from one ESP to another
Scenario: Switching from one SMTP provider to another and want to verify the new relay before cutover.
✓ Test new credentials. If they work, point the app at the new relay. If they don't, you have actionable diagnostics from the new ESP's response.
Diagnosing TLS-version-mismatch errors
Scenario: Provider tightened their minimum TLS version (e.g. now requires 1.2+). Your app uses an older library that defaults to TLS 1.0/1.1.
✓ A failed connection or TLS error shows up in the result with the server's message. Use it to tell whether the failure is at the TLS handshake rather than authentication.
Real SMTP transaction with real TLS handshake. The result is what a client connecting from Toolsana's server network sees, which may differ from your own network (firewalls, allowlists, port 25 blocks).
Credentials are sent to Toolsana's API to run the test and are not stored. The route logs the host, port, and mode of each test but not the password. Use app-specific passwords for extra safety.
Requests go through Toolsana's Cloudflare edge to our API.
Frequently Asked Questions
What's the difference between STARTTLS, TLS, and unencrypted?
STARTTLS (port 587) starts as plain TCP, then upgrades to encrypted via the STARTTLS command. Implicit TLS (port 465) is encrypted from the first byte. Unencrypted (port 25) doesn't use encryption — only appropriate for server-to-server relay between trusted internal hosts. Use STARTTLS or TLS for any SMTP server you authenticate against.
Why does Gmail reject my password?
Since 2022, Gmail / Google Workspace require an 'App Password' for SMTP authentication — your regular Google account password doesn't work. Generate an app password in Google Account → Security → 2-Step Verification → App passwords, and use that 16-character string. Same applies to Microsoft 365 (use app password if MFA is enabled).
What does 535 5.7.8 mean?
5xx codes are permanent failures. 535 specifically means authentication credentials rejected. The 5.7.8 enhanced status code narrows it: 'Authentication credentials invalid'. Translation: your username or password is wrong (or, in Gmail's case, you used your real password instead of an app password).
What does 421 mean?
4xx codes are transient — try again later. 421 specifically means 'service not available'. Often the server is overloaded, rate-limiting, or temporarily blocking your IP. Wait a few minutes and retry; if it persists, contact the provider.
What does 550 mean for RCPT TO?
5xx on RCPT TO is the recipient being refused. 550 is most common — could be 'recipient doesn't exist', 'recipient blocked', 'sender domain rejected as spam', 'relay denied' (if your auth wasn't accepted), or 'recipient on suppression list'. Read the full response text — providers usually explain.
Are my credentials stored?
They are sent to Toolsana's API, used only to perform the SMTP test, and not stored or used for anything else. Our route logs only the host, port, mode, and whether credentials were supplied, not the password. Use app-specific passwords (Gmail, Microsoft) where possible — even if a credential is exposed, it's scoped and revocable.
How does this differ from telnet smtp.example.com 25?
Telnet does the same SMTP commands but only over plain TCP — it can't easily test STARTTLS or implicit TLS, and you have to type the protocol commands yourself. This tool connects with STARTTLS or implicit TLS and gives a pass/fail result per step, but it doesn't show the raw command exchange.
Which ports and servers can I test?
The test accepts the four standard SMTP ports: 25 (server-to-server relay), 465 (implicit TLS submission), 587 (STARTTLS submission) and 2525 (a common alternative submission port some providers offer). Other ports are rejected, so the tool can't be used as a general port scanner. The host must be publicly reachable: private, loopback and link-local addresses are refused, both as IP literals and after DNS resolution, so an internal relay such as 10.0.0.5 or a name that resolves to one can't be tested from here. Each IP address can run 10 tests per hour.
Technical Specifications
Supported Formats
- ✓SMTP / ESMTP over TCP
- ✓STARTTLS (port 587), implicit TLS (port 465), unencrypted (port 25)
- ✓Ports 25, 465, 587 and 2525 only
- ✓Username/password authentication (mechanism negotiated automatically)
- ✓Test Connection (no delivery) or full Send Test (delivery + server response)
- ✓Server response text and warnings
Limits & Performance
- •File Size: Single SMTP server test per request
- •Validations: Live SMTP transaction (limited to 10 tests per hour)
- •Response Time: 1-15 seconds depending on server response time and TLS negotiation
- •Browsers: All modern browsers
Pro Tips
- Always use STARTTLS (port 587) or TLS (port 465) — never unencrypted SMTP for any production sending.
- Use app-specific passwords for Gmail / Microsoft / Yahoo. Your account password won't work and using it weakens security if leaked.
- Test with both 'Test Connection' (no actual delivery) and 'Send Test Email' — sometimes connect+auth pass but the message gets rejected at RCPT TO.
- If 5xx on AUTH, double-check whether the provider requires the username to be the full email address or just the local part. Different providers differ.
- Remember the test runs from Toolsana's servers, not your network. If your mail server only allows connections from specific IPs, or your app's network blocks port 25, the result here may differ from what your app sees.
- When testing a provider's SMTP relay, send the test email to a Gmail address. Then check the Gmail spam folder + view-original to see how Gmail rated your message — useful early signal on deliverability.
- Keep the From and To addresses on different domains for any meaningful test. Same-domain mail often takes a different code path inside ESP infrastructure.
Share This Tool
Found this tool helpful? Share it with others who might benefit from it!
💡 Help others discover useful tools! Sharing helps us keep these tools free and accessible to everyone.