SMTP Server Tester

Browsers enforce a strict security model: they cannot open raw TCP sockets. All HTTP requests go through the browser's networking stack which only supports HTTP/HTTPS/WebSocket protocols. Real SMTP operates on raw TCP (ports 25, 465, 587). To test live connectivity, use swaks, Telnet, or a server-side script from your production environment.

Port 25 is the original SMTP relay port — often blocked by ISPs and cloud providers (AWS, GCP, Azure) to prevent spam. Port 465 uses implicit TLS (SMTPS) — the connection is encrypted from the start. Port 587 uses STARTTLS — starts as plaintext then upgrades to TLS. Port 587 with STARTTLS is the recommended choice for application email submission.

STARTTLS is a protocol command that upgrades an existing unencrypted connection to TLS. It uses port 587. SSL/TLS (sometimes called SMTPS) creates an encrypted tunnel from the very first byte on port 465. Both are secure when properly configured — STARTTLS has a theoretical downgrade attack risk if the server doesn't enforce it, but modern servers do.

ISPs and cloud providers (AWS EC2, Google Cloud, Azure) block outbound port 25 by default to prevent spam. If you need to send email from a cloud VM, use port 587 through a transactional email service (SendGrid, Mailgun, Amazon SES) or request that your provider unblock port 25 for legitimate use cases.

Many providers (Gmail, Outlook) require an app-specific password for SMTP access when 2FA is enabled. These are separate from your account password and can be revoked independently. For Gmail: Account → Security → App passwords. For Outlook: Account settings → Security → Advanced security options.

Use swaks: swaks --to [email protected] --server smtp.gmail.com --port 587 --tls --auth-user [email protected] --auth-password yourpass. Or use Telnet: telnet smtp.example.com 587, then manually type EHLO, AUTH, MAIL FROM, RCPT TO, DATA. OpenSSL also works for TLS: openssl s_client -starttls smtp -connect smtp.gmail.com:587