Free Tool

SMTP Security Scanner

Scan your mail server for security vulnerabilities. Test STARTTLS encryption, open relay configuration, and SMTP enumeration risks.

Free instant check — no signup required

What is SMTP Security Testing?

SMTP security testing involves probing your mail server for vulnerabilities that could be exploited by attackers or lead to email deliverability problems. A misconfigured SMTP server can serve as an open relay for spammers, expose user information through enumeration commands, or transmit sensitive emails without encryption.

Key areas of SMTP security include transport encryption (STARTTLS/TLS), which protects email content in transit; relay restrictions, which prevent unauthorized use of your server; and information disclosure, where commands like VRFY and EXPN can reveal valid email addresses to attackers.

Regular SMTP security scanning is essential for maintaining a secure email infrastructure. Combined with proper SPF, DKIM, and DMARC configuration, a hardened SMTP server forms the foundation of trustworthy email delivery and protects your organization from abuse.

Frequently Asked Questions

What SMTP security features should I enable?
At minimum, enable STARTTLS to encrypt email in transit and disable the VRFY and EXPN commands to prevent user enumeration. Ensure your server is not an open relay — only accept mail from authenticated users or authorized IP ranges. Use a valid TLS certificate and disable old TLS versions (1.0 and 1.1). Consider enabling MTA-STS to enforce TLS from sending servers.
What is STARTTLS?
STARTTLS is an SMTP extension that upgrades a plain-text connection to an encrypted TLS connection. Without STARTTLS, email is transmitted in cleartext and can be intercepted or modified in transit. Most major email providers require STARTTLS for delivery. The command is sent after the initial EHLO response, and both sides negotiate a TLS session before transmitting the email.
Why is TLS important for email?
TLS encryption prevents man-in-the-middle attacks where an attacker intercepts email in transit. Without TLS, your email credentials, message content, and attachments are visible to anyone monitoring the network. Gmail marks emails received without TLS encryption with a broken padlock icon. Some enterprise mail filters reject unencrypted connections entirely. TLS also prevents downgrade attacks when combined with MTA-STS or DANE.
What is SMTP authentication?
SMTP authentication (SMTP AUTH) requires clients to prove their identity before the server will relay their messages. It prevents unauthorized use of your mail server for sending spam. Common mechanisms include PLAIN, LOGIN, and the more secure XOAUTH2. Authentication should only be offered over TLS-encrypted connections to prevent credentials being sent in cleartext.
How do I check if my mail server supports TLS?
Use our SMTP Security Scanner above — it connects to your domain's MX server and checks for STARTTLS support, the TLS version offered, certificate validity, and supported cipher suites. You can also test manually with: 'openssl s_client -connect mail.example.com:25 -starttls smtp' which will show the TLS handshake and certificate details.

Need continuous SMTP security monitoring?

Get automatic alerts when your mail server configuration changes. Monitor SMTP security, authentication records, and 60 blacklists.

Start Monitoring Free