Documentation
Complete reference for Smtpprobe — what it does, how to use it, what it does not do, and the honest limitations of this tool.
Contents
1. What Smtpprobe does
Smtpprobe is a diagnostic tool that answers one question: what does a mail server say when something connects to it?
It opens a real TCP connection to a mail server, reads the SMTP greeting banner, sends an EHLO command (the standard SMTP handshake), and returns a structured report showing:
- SMTP banner — the server's greeting, which usually identifies the software (Postfix, Exchange, Sendmail, etc.) and the hostname the server believes it has.
- STARTTLS detection — whether the server offers to upgrade a plain-text connection to encrypted communication.
- Authentication mechanisms — the methods the server advertises for client login (PLAIN, LOGIN, CRAM-MD5, etc.).
- Handshake timing — the round-trip time from connection open to receiving the first banner line.
- Full capability list — every EHLO response line the server sends.
- Raw SMTP transcript — the complete conversation for manual inspection.
The target user is a small-business owner or junior IT staff member diagnosing mail delivery problems, or anyone verifying a mail server they just configured. It is the check an admin would do by hand with a terminal, for people who do not have a terminal.
Speaking SMTP means opening a raw outbound TCP socket to port 25, 465, or 587 and reading a line-based protocol that is not HTTP. A browser cannot open a raw socket. Smtpprobe uses a server-side process (running Node.js with only the standard library — net and tls) to make the actual connection. This is a genuine architectural constraint, not a preference.
2. How to use it — step by step
Step 1: Navigate to the Probe page
Go to the App page. No account creation, no sign-up, no login — the page loads and is immediately ready to use.
Step 2: Enter a hostname
Type the hostname of the mail server you want to test. Enter just the hostname — no http:// prefix, no path, no trailing slash.
Examples:
mx.example.commail.yourcompany.comaspmx.l.google.comsmtp.gmail.comoutlook.office365.com
Step 3: Choose a port
Select one of the three standard mail ports:
| Port | Protocol | Typical use |
|---|---|---|
| 25 | Plain SMTP | Server-to-server mail transfer. Most mail servers listen here for incoming mail. Many residential and cloud networks block outbound port 25. |
| 465 | SMTP over TLS (implicit) | The connection is encrypted from the very first byte — before any SMTP command is sent. The probe uses tls.connect() for this port. |
| 587 | SMTP Submission | The standard port for mail clients to submit outgoing messages. Usually requires authentication. |
Step 4: Click "Probe"
Press the probe button. The tool sends a request to the backend, which opens a real SMTP connection to the target server. The results appear within a few seconds (or the tool reports a connection error or timeout).
Step 5: Read the results
Each result is presented as a structured card:
- Connection status — green checkmark if connected successfully, red X with error message if it failed.
- SMTP banner — the server's greeting line.
- STARTTLS — "Offered" (green badge) or "Not advertised" (amber badge).
- Auth mechanisms — comma-separated list of advertised mechanisms (e.g. PLAIN, LOGIN, CRAM-MD5).
- Handshake timing — milliseconds from connection start to first banner line.
- Full capabilities — every capability line from the EHLO response.
- Raw transcript — expandable section showing the exact byte-for-byte SMTP conversation.
Step 6: Interpret the results
Banner. A banner like 220 mail.example.com ESMTP Postfix (Ubuntu) tells you the server software (Postfix), the OS (Ubuntu), and the hostname it identifies with. If the hostname in the banner doesn't match the hostname you connected to, that is often a misconfiguration worth investigating.
STARTTLS. If STARTTLS is not offered, all data sent after the plain-text connection (including credentials if authentication is used) travels unencrypted. Many modern mail servers require STARTTLS before accepting AUTH.
Auth mechanisms. PLAIN and LOGIN send credentials in cleartext unless TLS is active. CRAM-MD5 is challenge-based and more secure. The presence of XOAUTH2 indicates OAuth 2.0 support (common with Gmail/Outlook).
Handshake timing. Values under 100ms indicate a nearby, responsive server. Values over 500ms suggest network distance, a loaded server, or firewall-induced latency.
3. How the probe works
The probe is a single Node.js file using only the standard library — http, net, and tls. No npm packages, no dependencies.
Connection flow
- Port 25 or 587 (plain TCP): The probe opens a
net.createConnection()socket. The server sends its SMTP banner immediately after the TCP handshake completes. No STARTTLS negotiation is performed — the probe reads the raw greeting the server offers before any upgrade. - Port 465 (implicit TLS): The probe opens a
tls.connect()socket. The TLS handshake completes first, then the server sends its SMTP banner over the encrypted channel.
What the probe sends
After receiving the banner, the probe sends:
This is the standard SMTP handshake command. Any SMTP server responds with a list of its capabilities, each line prefixed with 250- (intermediate) or 250 (final).
What the probe does NOT send
The probe never sends:
AUTH— it never attempts to authenticate, so credentials are never transmitted.MAIL FROM— it never initiates a mail transaction.RCPT TO— it never specifies a recipient.DATA— it never transmits email content.STARTTLS— it detects whether STARTTLS is advertised but does not perform the TLS handshake on plain ports.
Parsing
- starttls:
trueif the capabilities list contains "STARTTLS". - auth_mechanisms: extracted from the
AUTH ...capability line (e.g.,AUTH PLAIN LOGIN CRAM-MD5becomes["PLAIN", "LOGIN", "CRAM-MD5"]). - rtt_ms: milliseconds from connection start to receiving the first banner line.
Timeouts
- Total connection timeout: 10 seconds
- Banner timeout: 8 seconds after connection establishment
- If a banner is received but the EHLO response times out, results are returned with whatever was captured.
Architecture
The browser calls POST /api/probe on the same origin (no CORS issues). The Cloudflare Worker proxies the request to the droplet server-to-server. The droplet URL is set via the env.DROPLET_URL environment variable and is never exposed to the browser.
4. Result fields reference
Each probe returns a JSON object with the following fields:
banner string
The SMTP greeting banner — the first line the server sends after the TCP connection is established. Typically starts with 220 and identifies the server software and hostname.
capabilities array of strings
Every line returned by the server in response to EHLO, with the 250- / 250 prefix stripped. Each entry is one advertised capability (e.g., "SIZE 35882577", "STARTTLS", "SMTPUTF8").
starttls boolean
true if the capabilities include STARTTLS, false otherwise. Note: this only reports advertisement — it does not indicate whether the TLS handshake would succeed.
auth_mechanisms array of strings, or null
The authentication mechanisms the server advertises (e.g., ["PLAIN", "LOGIN", "CRAM-MD5"]). null if no AUTH capability line is present.
rtt_ms number
Milliseconds from the moment the TCP connection was initiated to the moment the first byte of the banner was received. This is a server-to-client round-trip measurement only — it does not include DNS resolution time.
port number
The port that was probed (25, 465, or 587). Echoed back from the request.
host string
The hostname that was probed. Echoed back from the request.
error string, or null
If the probe failed, a human-readable error message (e.g., "Connection refused", "Connection timed out"). null on success.
raw_transcript string
The complete SMTP conversation as a single string, with each line separated by \n. Useful for manual inspection when automated parsing is insufficient.
5. What Smtpprobe deliberately does NOT do
These are not bugs or missing features — they are intentional design boundaries:
No email sending
Smtpprobe does not send email. It connects to mail servers to read banners and capabilities. It never transmits email content, envelope data (MAIL FROM/RCPT TO), or any message body. This is a deliberate constraint — the product has no email sender.
No accounts, sign-ups, or login
There are no user accounts, no authentication, no session storage. The tool answers when you open the page — nothing to sign up for, nothing to configure.
No data storage or history
Probe results exist only in your browser during the current page session. Refreshing or navigating away clears them. No server-side database stores hostnames, results, or timestamps. Your browser's IP address is visible during the HTTP request (as with any web service) but is not logged or stored.
No scheduled or recurring probes
The tool answers when you ask it. There is no scheduler, no monitoring system, no alert mechanism, and no email notification system. If you want to check a server every five minutes, you need an external monitoring solution.
No STARTTLS handshake
The probe detects whether STARTTLS is advertised but does not perform the TLS upgrade. It does not validate certificates, test cipher suites, or verify that a TLS handshake would succeed. This is a conscious simplification — the probe reports what the server says it supports, not what it actually does.
No authentication attempted
Smptprobe never sends AUTH commands or any form of credentials. It reads the list of advertised authentication mechanisms but does not attempt to log in. No credentials are ever transmitted.
No port scanning
Only ports 25, 465, and 587 are accepted. Non-standard mail ports (e.g., 2525, 26, 25000) are rejected. This is a safety constraint that prevents the tool from being used for network reconnaissance.
No legal entity, no company name, no address
The business owner has not registered a legal entity or provided a registered address. The Terms of Service and Privacy Policy reflect this and will be updated when legal details are available.
No testimonials, usage numbers, or customer counts
This product has no real traffic data, customer list, or usage statistics. Any numbers shown on the site would be invented — therefore none are shown.
6. Honest limitations
These are genuine gaps — things that are not yet built or that the tool cannot do because of real constraints. They are documented here so you are never surprised by a limitation we knew about.
Simulated probe results (not yet connected to real backend)
The probe backend — a single Node.js file using net and tls — is written and tested but not yet deployed to production. All results you see on the site today are generated client-side with mock data. The "Demo mode" banner on every page is intentional and accurate. When the real backend is connected, the banner will be removed and all probes will connect to actual mail servers.
No IPv6 support
All probe connections are made over IPv4. IPv6 hostname resolution is not yet implemented. This will be added when the real backend is deployed.
No result export
Results cannot be exported as PDF, CSV, or any other format. They exist only in your current browser tab. Export features are planned for the Pro tier.
No API for programmatic access
There is no public API. The worker's /api/probe endpoint is intended for the frontend only. Programmatic access is planned for the Pro tier but not yet available.
No payment processor connected
The Pro plan at $12/month is listed on the pricing page, but no Stripe account or payment processor is connected. The checkout form on the pricing page is a demo only — no real payment can be taken. This requires operator action: create a Stripe account and wire the checkout.
Limited to three standard ports
Only ports 25, 465, and 587 are allowed. This is a deliberate safety constraint that also prevents misuse, but it means non-standard mail ports are not supported.
Timeout constraints on distant servers
The 10-second connection timeout may be insufficient for heavily firewalled or geographically distant servers. The Pro plan is expected to offer an extended 30-second timeout.
7. Frequently asked questions
Can I use Smtpprobe to check if my email will be delivered?
No. Smtpprobe reads what a mail server says when you connect. It does not attempt mail delivery, check SPF/DKIM/DMARC records, validate recipient addresses, or test whether the server will accept mail from you. It is a connection diagnostic tool, not a deliverability testing tool.
Can I test a server on a non-standard port like 2525 or 26?
No. Only ports 25, 465, and 587 are accepted. If your mail server uses a non-standard port, you will need to test it with a terminal-based tool such as openssl s_client or nc (netcat).
Does the probe work through a firewall?
It depends. Many residential and cloud networks block outbound port 25 by default. If the network hosting Smtpprobe's backend cannot reach the target server's port, the probe will report a connection error. Port 587 is more widely permitted but can still be blocked by restrictive networks.
Why is the tool showing simulated results?
Smtpprobe is in development. The probe backend is built but not yet deployed to production. The web app currently uses simulated results to demonstrate the interface. When the real backend is connected, the demo banner will be removed.
Does the probe authenticate or log in?
No. The probe never sends AUTH. It reads the list of advertised authentication mechanisms from the EHLO response but never attempts to authenticate. No credentials are involved at any point.
What does the probe do with the hostname I enter?
It resolves the hostname via DNS and opens a TCP connection to the resulting IP address on the selected port. That is all. The hostname is not stored, logged, or shared. It exists only in the transient network connection.
Does the probe validate TLS certificates?
No. On port 465 (implicit TLS), the probe performs the TLS handshake as part of the connection but does not validate the server's certificate. On ports 25 and 587 (plain), the probe does not perform STARTTLS at all — it only detects whether STARTTLS is advertised.
How is Smtpprobe different from openssl s_client or telnet?
Functionally, it does the same thing — open a raw connection and read the banner. The difference is usability: Smtpprobe presents the results as structured cards with clear labels and visual indicators (green/amber badges), whereas command-line tools require you to read raw protocol text. Smtpprobe is for people who do not have a terminal or prefer not to use one.
How is the product licensed?
The Free tier is available to everyone with no restrictions. The Pro tier is planned but not yet available. See the Pricing page for planned feature details.