SMTP Tester is an open-source SMTP diagnostic tool for developers and system administrators. It shows the full protocol exchange of a test in real time and never stores credentials.
Where other tools return a bare pass/fail or a generic timeout, SMTP Tester streams the raw, credential-redacted protocol exchange as it happens, so you can see exactly where a connection, handshake, or relay failed.
The project is freely available online at smtptester.org and as a self-hostable service published in the official GitHub repository.
Why we created SMTP Tester
Diagnosing SMTP issues usually means choosing between two poor options:
- Primitive command-line debugging: Running
telnet,openssl s_client, orswaksin a terminal requires memorizing raw SMTP verbs, manually constructing base64-encoded AUTH payloads, and interpreting cryptic response codes on the fly. They also produce no artifact you can share with a hosting provider, teammate, or vendor support desk. - Blackbox web forms: Most online SMTP checking tools take your host, port, and credentials into a form, spin a loader for twenty seconds, and output a generic "Authentication failed" or "Timed out" message. When a connection fails, you are left wondering: Did DNS fail? Was the port blocked? Did STARTTLS fail certificate validation? Or was the password rejected?
SMTP Tester solves both problems: the detail of a live terminal session in a web interface that is easier to read and share.
Core engineering principles
The architecture of SMTP Tester reflects three core principles:
1. Ephemeral execution & zero retention
SMTP Tester has no database, no persistent disk cache, and no tracking store. The credentials entered for a test are held strictly in server memory for the duration of that single TCP connection. The moment the test completes, the socket closes, or the browser disconnects, the memory is purged.
2. Live credential redaction
As the SMTP conversation streams, the engine parses each protocol line and redacts sensitive parameters—including AUTH PLAIN, AUTH LOGIN, and AUTH CRAM-MD5 base64 strings—before they reach your browser over Server-Sent Events (SSE). Transcripts can be screenshotted or pasted into issues and tickets without leaking credentials.
3. Absolute client control
If you close your browser tab or click "Stop" during a test, the server instantly receives an abort signal (AbortSignal) and terminates the underlying TCP socket and nodemailer transport immediately. No orphaned connections or background sends are left running.
Technical architecture
SMTP Tester is a TypeScript application with a clear client/server split:
- Backend Engine (Fastify & Node.js): A Fastify API server with Zod request validation and Nodemailer protocol event hooks, streaming line-by-line protocol output over Server-Sent Events (
/api/test). - SSRF Defense Layer: To prevent internal network scanning or relay abuse, the server resolves all target hostnames and validates IP addresses against the private, loopback, link-local, and reserved IPv4/IPv6 ranges (
127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1,fc00::/7,fe80::/10). - Parallel TLS Diagnostics: Alongside the SMTP session, a TLS probe inspects the server's certificate chain, cipher suite, negotiated TLS protocol version, and expiration date.
- Frontend SPA (React 19 & Tailwind CSS): A glassmorphic web interface with dark/light themes, accessible controls, dismissible setup hints, and inline status consoles.
- Self-Hosted Font Stack: All typography (Outfit, IBM Plex Mono, Dancing Script) is self-hosted as Latin-subset WOFF2 files, which keeps the Content Security Policy strict (
script-src 'self',font-src 'self') with no remote dependencies.
How an SMTP verification session works
Every test runs in four phases:
- Connect & Banner Inspection: The engine opens a TCP connection to the specified host and port (such as 587, 465, 2525, or 25), captures the server greeting banner (
220), and measures socket latency. - Capability Discovery (EHLO) & Security Upgrade: The client issues
EHLOto discover advertised SMTP extensions (PIPELINING, SIZE, STARTTLS, AUTH methods). If configured for STARTTLS (typical on port 587) or implicit TLS (port 465), encryption is negotiated and certificate properties are validated. - Authentication: The client authenticates using PLAIN, LOGIN, CRAM-MD5, or auto-negotiation. A
235 Authentication successfulconfirms valid credentials; a535isolates credential or permission issues. - Delivery Verification (Optional): If full testing is enabled, a test message from the rotating template catalog is sent to verify end-to-end queuing (
250 OK). For production servers where sending mail is undesirable, handshake-only mode verifies the entire connection and credential stack without queueing or sending any email.
For a breakdown of the handshake sequence, see the guide on what an SMTP test is and how it works.
The guides and knowledge base
The site also documents setup and troubleshooting for common providers. Each guide is checked against protocol specifications and real provider configurations:
- Transactional Relays: Setup guides for SendGrid, Amazon SES, SMTP2GO, Mailgun, Brevo, Resend, Mailjet, and SparkPost.
- Hosted Mailbox Providers: Configuration steps for Gmail, Office 365 & Outlook, and Zoho Mail.
- Self-Hosted MTAs: Verifying relay and submission policies for KumoMTA and PowerMTA.
- Protocol Deep Dives: Detailed references such as SMTP port 587 vs 465 and our walkthrough on fixing SMTP authentication error 535.
Open source & community
SMTP Tester is open-source software released under the MIT License. The complete source code, including the Fastify server, the React web app, and the documentation pipeline, is hosted on GitHub:
- Source Code Repository: github.com/worthmindbd/SMTP-Tester
- Container Deployment: Docker and Docker Compose files are included for private networks, staging environments, or offline labs.
For internal mail relays behind corporate firewalls or inside VPCs that public tools cannot reach, deploy a self-hosted instance.
Security disclosures and contact
We welcome contributions, bug reports, and provider guide suggestions:
- Bug Reports & Feature Requests: Open an issue on our GitHub repository.
- Security Inquiries & Vulnerability Reporting: Contact our security team at
privacy@smtptester.orgorhello@smtptester.org. - General Feedback: Reach out through our Contact page.