How to Set Up and Test an SMTP Server

Understanding SMTP Ports

One of the most common sources of SMTP configuration confusion is port selection. There are three ports in common use, and each has a specific intended use case:

Port	Protocol	Use Case	Recommended?
25	SMTP	Server-to-server MTA relay	For server-to-server delivery; hosting restrictions may apply
465	SMTPS	Implicit TLS for submission	Use when supported by your provider
587	SMTP + STARTTLS	Application mail submission	Use when supported by your provider

Use port 587 for all application SMTP. Port 587 uses STARTTLS, which upgrades a plain connection to an encrypted one after the initial handshake. Port 465 uses implicit TLS (the connection is encrypted from the first byte). Both are secure; 587 is the modern standard.

Configuring SMTP Authentication

All legitimate SMTP servers require authentication. The standard mechanism is SASL (Simple Authentication and Security Layer) with either the PLAIN or LOGIN method. Most mail libraries and SMTP clients support this automatically — you just need to provide the username and password.

Typical SMTP configuration for an application:

Host: smtp.yourmailprovider.com

Port: 587

Encryption: STARTTLS

Authentication: Yes (PLAIN or LOGIN)

Username: your-smtp-username

Password: your-smtp-password

For transactional email at scale, consider dedicated services like Amazon SES, SendGrid, Postmark, or Mailgun. These services handle IP reputation management, bounce handling, and email authentication setup for you.

SMTP Connection Flow

Understanding the step-by-step process of how an SMTP connection is established helps diagnose connection issues and configure clients correctly. The diagram below shows the typical flow from initial connection through authentication and message submission:

SMTP Connection Flow

Each step must succeed before moving to the next. If any step fails (e.g., authentication error at step 5), the connection is terminated and an error code is returned. For ports 465 and 587, encryption is handled differently: port 465 uses implicit TLS (encrypted from the first byte), while port 587 uses explicit TLS via STARTTLS (encryption begins after the initial handshake).

Testing SMTP Connectivity with Telnet

Before configuring your application, verify that the SMTP server is reachable from your host. The most reliable way to test SMTP connectivity is with Telnet:

telnet smtp.yourmailprovider.com 587

A successful connection will return:

220 smtp.yourmailprovider.com ESMTP ready

If you see Connection refused, the port is blocked or the service is not running. If you see a timeout, a firewall is likely dropping packets silently.

You can also perform a full SMTP handshake manually to test authentication:

EHLO yourdomain.com

STARTTLS

AUTH LOGIN

# Enter base64-encoded username, then password when prompted

Alternatively, use our SMTP Tester tool which performs this handshake automatically and shows you a detailed log of the connection.

Common SMTP Errors and How to Fix Them

550 5.7.1 — Message rejected (spam/authentication failure)

The receiving server rejected your message. Check that your SPF and DKIM records are correctly configured and that your sending IP is not on an RBL blacklist. Use our Blacklist Checker.

535 — Authentication failed

The username or password is incorrect, or the account does not have SMTP access enabled. For Google Workspace, ensure you have created an App Password if 2FA is enabled.

421 — Service temporarily unavailable

The server is overloaded or rate-limiting your connection. Wait and retry. If persistent, check if your IP has been temporarily blocked due to sending too many messages.

Connection timed out

A firewall is silently dropping packets on the SMTP port. Check outbound firewall rules on your server or cloud security group. Many cloud providers (AWS, GCP, Azure) block port 25 by default.

Choosing Between Self-Hosted and Managed SMTP

Self-hosting a mail server (Postfix, Exim, Sendmail) gives you complete control but requires ongoing maintenance: IP reputation management, bounce handling, TLS certificate renewal, and spam filter tuning. A compromised or misconfigured self-hosted mail server can get your IP blacklisted quickly.

For most applications, a managed transactional email service is the better choice. They provide dedicated sending infrastructure with strong IP reputations, built-in SPF and DKIM signing, bounce and complaint handling dashboards, and detailed delivery logs. The cost is typically low for transactional volumes (under 10,000 emails/month is often free on starter plans).

Frequently Asked Questions

Which SMTP port should I use — 25, 465, or 587?

Use port 587 with STARTTLS for all application email. Port 25 is for server-to-server relay and is blocked by most ISPs. Port 465 (implicit TLS) is still widely supported but 587 is the modern standard.

How do I test if an SMTP server is reachable?

Use telnet mail.example.com 587 — a successful connection shows a 220 greeting. You can also use our SMTP Tester tool for a full automated test with a detailed connection log.

What does "Connection refused" mean on SMTP?

The TCP connection was rejected — either a firewall is blocking the port, the mail service is not running on that port, or you are connecting to the wrong port. Check that the service is listening with netstat -tuln | grep 587 on Linux.

Transport reference: TLS for email submission and access. The provider’s supported endpoint and TLS mode determine the correct configuration.