How to Test a Mail Server on Ubuntu: SMTP, IMAP, POP3, TLS and Swaks

When email delivery fails, guessing wastes time. A structured Ubuntu mail server test can reveal whether the problem is DNS, a blocked port, TLS negotiation, authentication, or SMTP itself. This guide covers a lightweight Bash port test and complete SMTP diagnostics with swaks.

Quick answer: use the Bash script below to check several mail ports quickly. Use Swaks when you need to inspect EHLO capabilities, STARTTLS, authentication, or an actual test message.

What an Ubuntu Mail Server Test Should Cover

• DNS resolution for the mail hostname
• TCP connectivity to SMTP, submission, IMAP, and POP3 ports
• SMTP banner and EHLO capabilities
• TLS or STARTTLS negotiation
• Authentication and controlled message delivery

Standard Mail Server Ports

Port	Service	Purpose	Encryption
25	SMTP	Server-to-server transfer	Plain or STARTTLS
465	SMTPS	Message submission	Implicit TLS
587	Submission	Recommended client sending	STARTTLS
110 / 995	POP3 / POP3S	Mail retrieval	Plain / TLS
143 / 993	IMAP / IMAPS	Mailbox access	Plain / TLS

Port 25 may be blocked by providers to reduce spam. For authenticated client sending, port 587 with STARTTLS is usually the best first choice. Expose only the services your server intentionally provides.

Prerequisites

• Ubuntu 20.04 or newer
• sudo access for package installation
• The target mail server hostname or IP address
• Outbound firewall access to the ports being tested

Method 1: Test Mail Ports with Bash

This dependency-free script uses Bash’s /dev/tcp feature. It is excellent for reachability checks, but it does not validate certificates, authentication, or delivery.

nano test-smtp.sh

#!/bin/bash
SERVER="$1"
[ -z "$SERVER" ] && SERVER="smtp.example.com"
PORTS="$2"
[ -z "$PORTS" ] && PORTS="25 465 587 110 995 143 993"

IP=$(getent hosts "$SERVER" | awk '{print $1}' | head -n1)
[ -z "$IP" ] && IP="DNS resolution failed"

echo "Testing $SERVER ($IP)"
printf "%-8s %s\n" "PORT" "STATUS"

for PORT in $PORTS; do
  if timeout 5 bash -c "echo > /dev/tcp/$SERVER/$PORT" 2>/dev/null; then
    STATUS="OPEN"
  else
    STATUS="CLOSED/FILTERED"
  fi
  printf "%-8s %s\n" "$PORT" "$STATUS"
done

chmod +x test-smtp.sh
./test-smtp.sh mail.example.com
./test-smtp.sh mail.example.com "25 465 587"

OPEN proves only that a TCP connection succeeded. CLOSED/FILTERED may mean that no process is listening, a firewall rejected the connection, or packets were dropped. An open port does not prove that email delivery works.

Method 2: Test SMTP with Swaks

Swaks—the SMTP Swiss Army Knife—speaks the actual protocol. It displays server capabilities, negotiates TLS, authenticates, and can send a controlled test message.

Install Swaks on Ubuntu

sudo apt update
sudo apt install swaks
swaks --version

Inspect the SMTP banner and EHLO response

swaks --server mail.example.com --quit-after EHLO

This safe first diagnostic stops before sending. Look for capabilities such as STARTTLS, AUTH, message-size limits, and enhanced status codes.

Test port 587 with STARTTLS

swaks \
  --from sender@example.com \
  --to recipient@example.com \
  --server mail.example.com \
  --port 587 \
  --tls \
  --auth LOGIN \
  --auth-user sender@example.com

Let Swaks prompt for the password. Credentials placed directly in a command may appear in shell history or process listings. Always use a dedicated test account.

Test implicit TLS on port 465

swaks --to recipient@example.com --server mail.example.com --port 465 --tls-on-connect

Port 465 starts inside TLS; port 587 usually starts in plain SMTP and upgrades with STARTTLS. Mixing these modes commonly causes handshake errors.

Bash Script vs. Swaks

Capability	Bash	Swaks
Extra installation	No	Yes
Test several TCP ports	Yes	One endpoint per command
Inspect SMTP conversation	No	Yes
Test TLS and AUTH	No	Yes
Send a test message	No	Yes

Troubleshooting Common Errors

The hostname does not resolve

getent hosts mail.example.com
dig mail.example.com
dig MX example.com
nslookup mail.example.com

Confirm the hostname, DNS records, resolver configuration, and the domain’s MX records.

Every port times out

Check the service, Ubuntu firewall, cloud security group, network ACL, and provider restrictions. Start with sudo ufw status and sudo ss -lntp. A timeout often suggests filtering; an immediate refusal means the host is reachable but nothing is listening.

SMTP 535 authentication failed

Verify the full username, password, permitted authentication mechanism, and account policy. Providers using multi-factor authentication may require an app password or OAuth. Never disable MFA just to make a test pass.

TLS negotiation fails

Confirm the port and TLS mode, then inspect the certificate chain and hostname. Expired certificates, hostname mismatches, unsupported protocols, or missing intermediate certificates can break negotiation.

SMTP 550 message rejected

A 550 response is a policy or addressing rejection, not a connectivity failure. Read the complete response and check the recipient, relay policy, reputation, and domain authentication such as SPF, DKIM, and DMARC.

Mail Server Test Checklist

1. Resolve the hostname and verify MX records.
2. Check the intended TCP port.
3. Read the banner and EHLO capabilities.
4. Verify TLS mode and certificate.
5. Authenticate with a dedicated account.
6. Send one controlled message to an authorized mailbox.
7. Inspect received headers, SPF, DKIM, and DMARC results.
8. Review logs and remove test credentials.

Frequently Asked Questions

What is the best SMTP testing tool on Ubuntu?

Swaks is best for detailed SMTP diagnostics because it exposes the protocol conversation and supports TLS, authentication, and delivery. Bash /dev/tcp is faster for basic reachability.

Does an open port mean the mail server works?

No. It proves only that TCP connects. TLS, authentication, relay authorization, or final delivery may still fail.

Should I use port 25, 465, or 587?

Use port 587 with STARTTLS for normal authenticated submission unless your provider specifies otherwise. Port 465 uses implicit TLS. Port 25 is mainly server-to-server and is commonly restricted.

Conclusion

A reliable Ubuntu mail server test moves through DNS, TCP reachability, SMTP capabilities, TLS, authentication, and finally delivery. Start with Bash for a quick overview, then use Swaks to identify exactly where mail flow breaks.

References: the original Mail Server Test Ubuntu wiki guide, the official Swaks project, and Ubuntu’s APT guide.