IT Toolbox
Guide

How to test a SMTP server with OpenSSL

OpenSSL allows you to check the connection to the server, the borough and the certificate presented by a SMTP server before even testing the authentication.

TopicIT Networking →
⌚ About 2 min read
View my favorites
Email / SMTP Intermediate. 10 min

OpenSSL allows you to check the connection to the server, the borough and the certificate presented by a SMTP server before even testing the authentication.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Choose the right port

    Generally use 587 with ▼TLS or 465 in TLS implicit depending on the supplier.

  2. 2

    Open the TLS session

    Run s_client with -2003tls smtp for port 587.

  3. 3

    Read the certificate

    Control CN/SAN, dates and chain.

  4. 4

    Test EHLO

    Enter EHLO to see the advertised capabilities.

  5. 5

    Compare with the application

    Then, host, port and mode TLS in the software.

Commands utiles

opensl s_client -connect smtp.example.fr:587 - 2018tls smtp -servername smtp.example.fr
opensl s_client -connect smtp.example.fr:465 -servername smtp.example.fr

À retenir

  • Do not paste a real password into a shared terminal history.
  • A successful TLS handshake does not validate the authorization of sending.
  • Keep the exact text of, if any, 535 or 550.
← All les guides
Technical deep dive

SMTP STARTTLS: verify capability, then handshake

Technical checkpoints

  • STARTTLS is advertised after EHLO; the client then requests upgrading the clear SMTP session to TLS.
  • The presented certificate should match the hostname used by the client and build a trusted chain.
  • A server can accept port 587 while refusing AUTH before STARTTLS depending on policy.

OpenSSL SMTP

Use -starttls smtp to negotiate EHLO/STARTTLS correctly instead of raw TLS.

openssl s_client -starttls smtp -connect smtp.example.com:587 -servername smtp.example.com

Topic-specific pitfalls

  • Testing only telnet:587 does not validate the TLS certificate.
  • Port 465 generally uses implicit TLS, unlike STARTTLS on 587.

How to validate

  • EHLO advertises STARTTLS and the handshake completes with the expected chain/hostname.
  • The intended AUTH method then works within the encrypted session.
♡ 0