Help Centre

smtplens supports three standard mail ports:

If you're not sure, start with port 587 — it is the most widely supported for client submission and the default selection in smtplens.

A Connection refused error means the server actively rejected the connection attempt. Common causes:

• The server is not running a mail service on that port.
• A firewall is blocking inbound connections to that port.
• The hostname resolves to the wrong IP address.
• Your network (or smtplens' probe endpoint) is blocked by the server's firewall.

If the probe times out instead (15 seconds on the free tier), the server is not responding at all — likely a network-level block or the host is unreachable.

No to all three. smtplens is stateless by design:

• It does not authenticate, log in, or send any credentials. It only reads the SMTP greeting banner and the EHLO capability list.
• It does not send email messages. No data is transmitted to the target server beyond EHLO smtplens.
• Probe results are returned to your browser and immediately discarded by the backend. No hostnames, ports, or probe outputs are stored or logged.
• The tool does not set cookies, use analytics, or employ third-party trackers. See the Privacy Policy for details.

If STARTTLS does not appear in the EHLO response, the server is not offering TLS upgrade on that port. This is common on port 25 (plain SMTP) where encryption is optional, but unusual on port 587 (submission) where STARTTLS is widely expected.

Possible reasons:

• The server has TLS misconfigured or disabled on that port.
• The certificate or TLS library is not properly installed.
• Some servers only advertise STARTTLS after receiving certain EHLO parameters — this is rare but does happen.

Try probing on port 465 (implicit TLS) instead, which negotiates TLS before any SMTP command exchange and does not depend on STARTTLS being advertised.

After connecting, smtplens sends EHLO smtplens and the server replies with a list of SMTP extensions it supports. Each line (after the initial 250- prefix) advertises a capability:

• PIPELINING — the server accepts multiple commands in a batch without waiting for individual responses.
• SIZE nnnnnn — the maximum message size the server accepts (in bytes).
• STARTTLS — the server supports upgrading the connection to TLS.
• AUTH PLAIN LOGIN ... — the authentication mechanisms the server accepts.
• 8BITMIME — the server accepts 8-bit character data (UTF-8, etc.) in message bodies.
• DSN — the server supports Delivery Status Notifications.
• ENHANCEDSTATUSCODES — the server returns enhanced (RFC 2034) status codes.

A short EHLO response may indicate a minimalist server configuration; a long one is normal for full-featured MTAs like Postfix, Exim, or Exchange.

Many residential ISPs, cloud providers (AWS, DigitalOcean, Google Cloud), and enterprise networks block outbound port 25 by default to prevent spam. This is not a problem with smtplens — it is a network restriction between the probe endpoint and the target server.

Try the same host on port 587 or 465 instead. If you specifically need to test port 25, you may need to run the probe from a network that does not block it (e.g., your own on-premises server).

Not necessarily. It depends on the role of the server:

• Port 25 (server-to-server): AUTH is often not advertised, because mail relaying between servers does not require authentication.
• Port 587 (submission): AUTH should be advertised, because this port is used by email clients (Outlook, Thunderbird, etc.) to submit outgoing mail.
• Port 465 (SMTPS): AUTH is usually expected, similar to port 587.

If you are probing your own mail server on port 587 and AUTH is missing, your mail client will not be able to send email through it — check the server's SMTP auth configuration.