Question 1

What is an online SMTP test?

Accepted Answer

An online SMTP test opens a TCP connection to your mail server, reads the SMTP greeting, sends EHLO, optionally upgrades the session with STARTTLS or implicit TLS, authenticates if credentials are provided, and may submit a real message (MAIL FROM, RCPT TO, DATA). SMTP Tester is a free SMTP test and SMTP test tool that streams every client and server line in a live transcript (with passwords redacted) so you can see exactly where a configuration fails—TLS negotiation, AUTH, or relay policy—without guessing from a generic error dialog.

Question 2

Can I run an SMTP test online or test my mail server online?

Accepted Answer

Yes. SMTP Tester is an online SMTP test and SMTP test online tool—enter host, port, security, and credentials in your browser to test your mail server online without installing telnet, OpenSSL, or swaks. Use it to check SMTP server connectivity from any network (including where outbound port 25 is blocked), send an optional test message, or run handshake-only mode to verify TLS and auth without delivering mail. Credentials are used once per test and are not stored on the server.

Question 3

How do I check an SMTP server or use an SMTP connection tester?

Accepted Answer

To check SMTP server settings, enter the hostname and port your app or provider documents, pick the matching security mode (STARTTLS on 587, implicit TLS on 465, or none on 25), and run a test. SMTP Tester works as an SMTP connection tester and SMTP server test tool: it shows the full EHLO capabilities, whether STARTTLS succeeded, the AUTH result, and any relay rejection in a live transcript. If you only need connect → EHLO → TLS → AUTH, enable handshake-only mode instead of sending a message.

Question 4

Can I run an SMTP relay test online?

Accepted Answer

Yes. An SMTP relay test online verifies whether your server accepts MAIL FROM and RCPT TO for the addresses you specify—after connect, EHLO, TLS, and AUTH. SMTP Tester runs that full sequence and shows each server response in the transcript, so you can tell an authentication failure (535) from a relay policy block (550/553) from a TLS problem. For open-relay audits on port 25, also use a dedicated open-relay checker; SMTP Tester focuses on authenticated submission and injection paths on 587, 465, and 2525.

Question 5

How do I run an SMTP test port 587, SMTP test port 465, or test SMTP port 25?

Accepted Answer

Set the port field to 587, 465, or 25 and SMTP Tester picks a default security mode: 587 and 2525 → STARTTLS, 465 → implicit TLS, 25 → none. An SMTP test port 587 checks STARTTLS upgrade after EHLO; an SMTP test port 465 negotiates TLS immediately on connect; a test SMTP port 25 is mainly for server-to-server relay or local MTA injection—many cloud and ISP networks block outbound 25, so try 587 or 465 for app submission. The TLS diagnostics panel confirms encryption after any successful upgrade.

Question 6

Does SMTP Tester work as an SMTP authentication checker?

Accepted Answer

Yes. SMTP Tester is an SMTP authentication checker: it runs AUTH PLAIN, LOGIN, CRAM-MD5, or auto-detect after TLS and shows whether the server returns 235 (success) or 535 (authentication failed) in the transcript—with passwords redacted. Use handshake-only mode to check credentials without sending mail. If you see 535, read the matching line in the transcript and see the fix 535 authentication errors guide for app passwords, API-key vs SMTP credential mix-ups, and username format issues per provider.

Question 7

Can I run an SMTP TLS test or use SMTP Tester as an SMTP handshake tester?

Accepted Answer

Yes. For an SMTP TLS test, connect with STARTTLS (587) or implicit TLS (465); SMTP Tester reports negotiated protocol, cipher, certificate subject, issuer, and expiry in a separate TLS panel. As an SMTP handshake tester, enable handshake-only mode to run connect → EHLO → STARTTLS/TLS → AUTH without MAIL FROM, RCPT TO, or DATA—ideal for verifying production hosts without queuing a message. A handshake success confirms the session and auth path, not guaranteed delivery to external domains.

Question 8

Is SMTP Tester an SMTP debugging tool or SMTP command tester?

Accepted Answer

Yes. SMTP Tester is an SMTP debugging tool and SMTP command tester: every client command (EHLO, STARTTLS, AUTH, MAIL FROM, RCPT TO, DATA) and server reply appears in a filterable live transcript—the same detail you would get from swaks or openssl s_client, but in the browser. Filter to client, server, or error lines; copy the redacted transcript into a ticket; export JSON with stages and TLS details. It is a practical way to test outbound SMTP server behavior from machines that cannot run CLI SMTP tools.

Question 9

My test says succeeded but the email never arrived. Did it really send?

Accepted Answer

A successful test means your SMTP server accepted the message during the DATA phase—typically a 250 response that may include a queue ID (for example on Exim or PowerMTA). That is SMTP submission success, not a guarantee the message reached the recipient's inbox. Delivery can still fail afterward because of DNS (MX), greylisting, spam filtering, missing SPF/DKIM/DMARC, or provider-specific rules. To verify end-to-end delivery, send a test to an inbox you control (Gmail, Outlook, etc.) and check your server's mail logs for that queue ID. Tools like mail-tester.com score inbound mail separately and can delay or filter messages even when your SMTP session looked perfect.

Question 10

Which SMTP port should I use—25, 465, 587, or 2525?

Accepted Answer

Port 587 with STARTTLS is the modern standard for mail submission from apps and clients (RFC 6409). Port 465 uses implicit TLS (SMTPS) and is still common for legacy providers. Port 25 is for server-to-server relay; many cloud hosts block outbound 25 to reduce spam, so use 587 or 465 for authenticated submission instead. Port 2525 is a non-standard alternative that many providers (SendGrid, Mailgun, Brevo, Postmark) also accept when 587 is blocked by a firewall or ISP. SMTP Tester picks a sensible default when you change the port: 465 → TLS, 25 → none, other ports (including 587 and 2525) → STARTTLS. If you are unsure, start with 587 and STARTTLS.

Question 11

Are my SMTP username and password stored on your server?

Accepted Answer

No. Credentials are sent only in the HTTPS request body for a single test run, used to connect to your SMTP server, and never written to disk or a database on SMTP Tester. The protocol transcript redacts AUTH payloads and passwords before anything is shown in the browser or returned in the JSON export. If you save a profile, it is stored only in your browser's local storage—you can omit the password when saving and enter it each time.

Question 12

Which authentication methods are supported?

Accepted Answer

You can choose Auto-detect, AUTH PLAIN, AUTH LOGIN, AUTH CRAM-MD5, or no authentication. Auto works for most providers. PLAIN is required by some MTAs (including KumoMTA, which does not support LOGIN). LOGIN is still used by older hosts. CRAM-MD5 is rare but supported when the server advertises it. If you see authentication failed (535), try the method your server documents, confirm the username format (full email vs local part), and use an app-specific password where the provider requires it.

Question 13

How do I fix SMTP error 535 "authentication failed" / "username and password not accepted"?

Accepted Answer

A 535 5.7.8 response means the SMTP server rejected your credentials—the connection and TLS were fine, only AUTH failed. Work through the common causes: (1) Use an app password, not your normal login, if the account has 2-Step Verification (Gmail, Microsoft 365, Yahoo). (2) Check the username format the provider expects—often the full email address, but a fixed string for some services (apikey for SendGrid, resend for Resend, SMTP_Injection for SparkPost). (3) Make sure you are pasting an SMTP credential, not an HTTP/REST API key, where the provider issues them separately (Mailgun, Brevo, Postmark). (4) Remove stray spaces or line breaks from a copied key. (5) Confirm the right auth method—try AUTH PLAIN or LOGIN explicitly if Auto fails. SMTP Tester shows the exact line where 535 appears in the transcript (with the password redacted) so you can tell an auth problem from a TLS or relay problem.

Question 14

Is this an online alternative to telnet, openssl s_client, or swaks?

Accepted Answer

Yes. Admins traditionally debug SMTP from the command line with telnet host 25, openssl s_client -starttls smtp -connect host:587, or swaks. SMTP Tester runs the same EHLO → STARTTLS/TLS → AUTH → MAIL FROM → RCPT TO → DATA sequence from your browser and streams every client and server line back as a live transcript—no local tools, no installing OpenSSL or Perl, and it works from machines where outbound port 25 is blocked. It also adds a TLS certificate probe (protocol, cipher, issuer, expiry) that telnet cannot show, and it redacts credentials so transcripts are safe to copy into a ticket or forum post.

Question 15

What does handshake only mean?

Accepted Answer

Handshake only runs connect, EHLO, STARTTLS/TLS, and AUTH without sending MAIL FROM, RCPT TO, or DATA. It is the same path an SMTP handshake tester uses when you want to verify host, port, TLS, and credentials without delivering a message—useful on production systems where you must not trigger a real send. A handshake success does not prove your server will relay to external domains; it only proves the session and auth path work.

Question 16

Why does SendGrid SMTP fail with username "apikey"?

Accepted Answer

SendGrid SMTP does not use your Twilio/SendGrid login email as the username. The username must be the literal string apikey (all lowercase), and the password is a SendGrid API key with Mail Send permission—not your account password. If 2FA is enabled on the account, basic username/password auth is rejected with 535 (basic authentication is not allowed with 2FA enabled). Use smtp.sendgrid.net on port 587 with STARTTLS (or 2525 if 587 is blocked). Do not base64-encode the username or password in app config; paste the raw values. A 535 after correct-looking settings often means an old account password, a truncated API key, or missing Mail Send scope on the key.

Question 17

Amazon SES SMTP works but I get 554 — email address is not verified. Why?

Accepted Answer

SMTP authentication can succeed while SES still rejects the message after DATA. In sandbox mode you may only send from verified identities and only to verified recipient addresses (up to 200 messages per day). The 554 text names the identity that failed verification in that AWS Region. Verify the From domain or address in the same Region as your endpoint (for example email-smtp.us-east-1.amazonaws.com). SMTP credentials from the SES console are Region-specific—do not mix a us-east-1 endpoint with credentials created in eu-west-1. Request production access in the SES console to send to arbitrary recipients. A 250 from SMTP Tester means the server accepted the session; a later 554 in the transcript is SES policy, not a wrong password.

Question 18

Can I use my Mailgun API key as the SMTP password?

Accepted Answer

No. Mailgun separates HTTP API keys from per-domain SMTP credentials. In the control panel go to Sending → Domain settings → SMTP credentials for the domain you send from. The username looks like postmaster@your-domain.com (or another SMTP user you created); the password is the SMTP user password shown once when you create or reset it—not your Mailgun account password and not the private API key. Use smtp.mailgun.org for US domains or smtp.eu.mailgun.org for EU on port 587 with STARTTLS. Error 535 Invalid login on forums almost always means API key in the password field or the wrong domain’s SMTP user.

Question 19

Postmark SMTP authentication failed — which token do I use?

Accepted Answer

For smtp.postmarkapp.com use the Server API token from that server’s API Tokens page as both the SMTP username and password (the same string twice). The Account API token used to manage servers will not authenticate for sending. Broadcast streams use smtp-broadcasts.postmarkapp.com. If your client cannot set custom headers, create an SMTP token on the message stream (Access Key = username, Secret Key = password). Enable SMTP access on the stream in Postmark settings. Use port 587 with STARTTLS or 2525 if blocked. Copy the token carefully—leading or trailing spaces cause 535 errors that look like a bad password.

Question 20

Brevo (Sendinblue) SMTP login fails — should I use my API key?

Accepted Answer

Brevo issues separate credentials for REST and SMTP. For smtp-relay.brevo.com the username is your SMTP login email from Settings → SMTP & API → SMTP; the password is an SMTP key from the SMTP keys section—not a v3 API key from API Keys & MCP and not your Brevo account password. WordPress and other plugins often fail with unauthorized or key not found when the API key is pasted into SMTP settings. Regenerate the SMTP key if unsure, copy it immediately, and confirm your transactional account is active. Port 587 with STARTTLS is the usual choice; 465 works for implicit TLS.

Question 21

What username and password does Resend SMTP use?

Accepted Answer

Resend SMTP at smtp.resend.com uses the fixed username resend (lowercase) and your Resend API key as the password. This is the same key used for the HTTP API, not a separate SMTP secret. Use port 587 with STARTTLS or 465 with TLS; Resend recommends 465 for SSL if your client offers both. The From address must use a domain you have verified in Resend. If AUTH succeeds but sending fails, check domain verification and API key permissions rather than swapping the username for your email address.

Question 22

SparkPost SMTP keeps rejecting my login — what credentials are correct?

Accepted Answer

SparkPost SMTP uses host smtp.sparkpostmail.com on port 587 with STARTTLS. The SMTP username is SMTP_Injection (that exact string). The password is a SparkPost API key that has Send via SMTP enabled in the key permissions—not your SparkPost account password. Subaccounts need a key created in that subaccount. Forum threads often confuse the REST API key format with SMTP or omit the SMTP_Injection username. After 235 AUTH, ensure your From domain is verified in SparkPost or transmissions may fail after acceptance.

Question 23

Mailjet SMTP authentication — API key, secret key, or something else?

Accepted Answer

Mailjet SMTP at in-v3.mailjet.com (port 587, STARTTLS) uses your Mailjet API key as the username and your secret key as the password—both from Account → API keys. This pair is not the same as SMTP credentials some other providers issue separately, but it is still distinct from your Mailjet login password. Sandbox mode and sender-domain validation can cause sends to fail after AUTH with policy errors; check that the From address matches a validated sender or domain in Mailjet.

Question 24

How do I test KumoMTA with SMTP Tester?

Accepted Answer

KumoMTA does not ship a single global SMTP hostname—you configure listeners in Lua with kumo.start_esmtp_listener. For authenticated submission, a common pattern is port 587 with STARTTLS and AUTH PLAIN via the smtp_server_auth_plain event; AUTH must occur on an encrypted session after STARTTLS. Set the host to your server's public hostname or IP, match the port you configured, choose PLAIN if Auto fails, and ensure your injecting IP is allowed (relay_hosts or auth). Port 25 is often used for relay without auth on trusted networks only. See the KumoMTA guide on this page for listener and auth examples.

Question 25

How do I test PowerMTA (PMTA) submission?

Accepted Answer

By default PowerMTA accepts injection from 127.0.0.1 on port 25 without external relay. For remote or authenticated submission you must add smtp-listener (for example 0.0.0.0:587), define smtp-user credentials, and a source block with smtp-service yes and require-auth true (and often always-allow-relaying yes for authenticated injectors). Use STARTTLS on 587 when allow-starttls is enabled. In SMTP Tester, enter your listener host, port, PLAIN or LOGIN auth, and send to an address your virtual MTA is allowed to deliver. A 250 after DATA with a PMTA queue id means injection succeeded; check pmta log files for downstream delivery.

Question 26

TLS or certificate errors during the test

Accepted Answer

If the server uses a self-signed or mismatched certificate, the test may fail when Reject invalid TLS certificates is enabled in Advanced settings. Disable that option only for debugging in a trusted environment. For production, fix the certificate (correct hostname in CN/SAN, trusted CA, not expired). SMTP Tester also shows TLS protocol, cipher, and expiry from a separate probe when STARTTLS or implicit TLS is used.

Question 27

Connection timed out on port 25

Accepted Answer

Many VPS and residential networks block outbound port 25. Switch to 587 (STARTTLS) or 465 (TLS) for submission. If you operate your own MTA, open the submission port in the firewall and configure the listener in KumoMTA, PowerMTA, or Postfix accordingly—not only port 25.

Question 28

How is SMTP Tester different from smtper.net?

Accepted Answer

Both tools connect to your SMTP server and can send a test message. SMTP Tester adds a live, credential-redacted protocol transcript, TLS certificate diagnostics, multiple auth methods (PLAIN/LOGIN/CRAM-MD5/auto, works with KumoMTA and PowerMTA), rotating HTML test templates, handshake-only mode, and JSON export of results. Neither tool stores passwords on the server; SMTP Tester additionally keeps saved profiles only in your browser.

SMTP Tester — free online SMTP test tool