+90 850 840 83 05
    Support RequestStudent DiscountCampaignsWiki
    Build automated workflows with N8N!•Free .com.tr domain on annual purchases•Virtual Server plans starting from ₺149.90•Free SSL certificate on all plans•10% off VDS and Performance servers with code TANISMA2026•Build automated workflows with N8N!•Free .com.tr domain on annual purchases•Virtual Server plans starting from ₺149.90•Free SSL certificate on all plans•10% off VDS and Performance servers with code TANISMA2026•

    SMTP Test Tool — Connection, TLS and Delivery Check

    Validate your port and encryption settings, then generate the SMTP test commands and DNS checklist to run on your server.

    Runs in your browser, no data sent Free · No sign-up required

    Selected from the port: STARTTLS

    There is deliberately no password field: the generated commands leave a <SIFRE> placeholder for you to fill in your terminal. Never type your SMTP password into a web page.

    Configuration diagnosis

    587 — the submission port (RFC 6409). The right choice for authenticated sending from apps and clients; the connection starts in the clear and is encrypted with STARTTLS.

    Test commands

    # 1) Connection + TLS certificate check
openssl s_client -starttls smtp -crlf -connect mail.example.com:587 -servername mail.example.com

# 2) Once connected, type:
EHLO mail.example.com
QUIT

# Expected: a 220 greeting, then 250 replies to EHLO with the capability list (AUTH, STARTTLS, SIZE...).

    Run the commands on your own computer or server. This page opens no connection — browsers cannot make raw SMTP connections.

    Delivery chain (DNS) check

    # PTR (reverse DNS) — must match the HELO name EXACTLY
dig +short -x <SUNUCU_IP>          # → mail.example.com

# A record of the HELO name — must resolve back to the server IP (forward/reverse match)
dig +short A mail.example.com

# SPF — the sender domain must have exactly one v=spf1 record
dig +short TXT example.com

# DKIM — the public key of your signing selector
dig +short TXT default._domainkey.example.com

# DMARC — tells receivers what to do with the SPF/DKIM result
dig +short TXT _dmarc.example.com

# MX — where replies and bounces will be delivered
dig +short MX example.com

# On Windows, if dig is unavailable, the same lookups with nslookup:
nslookup -type=TXT _dmarc.example.com

    The PTR record is set by the owner of the IP block, not by your domain provider. On a Clou.TR Dedicated SMTP Node you give us the hostname you want when ordering and we set the record — Dedicated SMTP Node plans.

    Why is an SMTP test run from the terminal?

    SMTP is a protocol browsers cannot speak: JavaScript cannot open a raw TCP socket, so a web page cannot 'really' connect to your server. This tool therefore does two things — it checks your configuration at the points where it most often breaks, and it generates commands filled in with your values to run in your own terminal. Your password is never requested.

    Which port should you use?

    • 587 — Submission (STARTTLS): The standard path for authenticated sending from apps and clients.
    • 465 — Implicit TLS (SMTPS): Encrypted from the first byte; the STARTTLS command is not used.
    • 25 — MTA delivery port: For server-to-server delivery. Most ISPs block it outbound.
    • 2525 — Alternative submission: Non-standard; used when 587 is blocked, behaving the same as 587.

    Common SMTP reply codes

    • 220 — Server ready (greeting line).
    • 250 — Command accepted. A 250 'queued' after DATA means the message was taken for delivery.
    • 235 — Authentication succeeded.
    • 354 — Send the message body, ending with a single dot on its own line.
    • 421 / 450 / 451 — Temporary failure; the send should be queued and retried (greylisting is usually this).
    • 530 / 535 — Authenticate first / credentials rejected.
    • 550 — Permanent rejection: no such mailbox, recipient refused, or the IP is blacklisted.
    • 552 / 554 — Size exceeded / transaction failed (often the spam filter).

    The delivery chain: PTR → SPF → DKIM → DMARC

    Passing a connection test does not mean the email will land in the inbox. Receiving servers check, in order: does the connecting IP's PTR record match the HELO name, does the sender domain's SPF record authorize this IP, does the DKIM signature verify, and is the DMARC policy aligned with those results. The first link in the chain, the PTR record, does not live in your domain's DNS but with the owner of the IP block; on a Clou.TR Dedicated SMTP Node we set that record for you.

    Frequently Asked Questions

    No. Because browsers cannot open raw TCP sockets, no web page can perform an SMTP handshake directly. Doing it through a proxy server would mean sending your SMTP password to a third party. Instead, this tool validates your configuration (port ↔ encryption compatibility, HELO/PTR match) and generates ready-to-run test commands for your own terminal.

    If you send authenticated mail from your app or mail client, use 587 + STARTTLS — that is the standard submission path. Port 465 is implicit TLS, encrypted from the first byte, and equally secure. Port 25 is only for server-to-server delivery; since most ISPs block outbound 25, testing it from a home or office connection will time out. Port 2525 is the non-standard alternative used when 587 is blocked.

    There are three common causes: (1) your ISP or cloud provider blocks the outbound port — especially 25; (2) the server's firewall is not listening on that port; (3) the wrong encryption mode is selected — connecting to 465 with STARTTLS hangs in the middle of the handshake. First confirm the port is open with 'Test-NetConnection' or 'nc -vz', then try the TLS handshake with openssl.

    The server accepted the connection but rejected your credentials. Common causes: using just the username where the full email address is required, a stray space or newline pasted into the password, an account without sending permission, and AUTH being disallowed by the server on an unencrypted connection. Note the difference from 534/530: a 530 usually means 'authenticate first', i.e. AUTH was never performed.

    The PTR record lives in the records of the provider that owns the IP block, not in your domain's DNS — so you cannot change it from your own DNS panel. On a Clou.TR Dedicated SMTP Node you are asked for the hostname you want when ordering and we set the record; to change it later you simply open a support ticket, free of charge. It must match your server's HELO/EHLO name exactly, and the A record of that name must resolve back to the same IP; without this forward/reverse match, Gmail and Outlook reject the connection outright.

    Passing a connection test does not mean deliverability is fine. Verify in order: does the PTR record match the HELO name, does the sender domain have exactly one valid SPF record, does the DKIM signature verify, is a DMARC record published. Then look at IP reputation — a sudden high volume from a new IP is flagged as a 'spam burst', which is why volume must be raised gradually over 2-3 weeks (warm-up). Finally your list: send only to opt-in addresses and remove hard bounces.

    Related Tools

    .htaccess Redirect Generator

    Create Apache .htaccess rules for WWW, HTTPS and individual URL redirects.

    Strong Password Generator

    Generate strong, random and hard-to-crack passwords locally in your browser.

    Hash (SHA) Generator

    Instantly compute the SHA-1, SHA-256, SHA-384 and SHA-512 digests of your text in the browser.

    View All Tools

    Fast, secure, Turkey-based hosting

    Move your website to Clou.TR with NVMe SSD, free SSL and a 99.9% uptime guarantee.

    View Hosting PlansServer Solutions