Testing SMTP by hand with swaks and openssl

When an application says "SMTP error" and nothing more, the quickest way to the truth is to talk to the mail server yourself. Two command-line tools cover almost every case: swaks for scripted SMTP conversations, and openssl s_client for seeing exactly what happens during TLS.

Why test by hand#

Mail libraries hide the conversation. They report "authentication failed" or "connection refused" and discard the server's actual words, which usually contain the real answer: a specific enhanced status code, a policy message, or a hint about which extension is missing. Talking to the server directly shows you every reply line.

Use these tools against servers you operate or are authorized to test, such as your own relay, your provider's submission endpoint with your credentials, or a test mailbox you own. Sending test messages to arbitrary third-party servers can look like abuse.

swaks: the Swiss Army knife for SMTP#

swaks (Swiss Army Knife for SMTP) is a single script available in most package managers. It runs a complete SMTP transaction and prints both sides.

A basic transaction#

swaks --server mail.example.com --port 587 \
      --from [email protected] --to [email protected] \
      --header "Subject: swaks test" --body "Hello from swaks"

The output marks client lines with -> and server lines with <-, so you see the greeting banner, the EHLO response with advertised extensions, and each reply code.

Testing STARTTLS and authentication#

Most submission servers on port 587 expect STARTTLS and then authentication:

swaks --server mail.example.com --port 587 --tls \
      --auth PLAIN --auth-user [email protected] --auth-password "$SMTP_PASSWORD" \
      --from [email protected] --to [email protected]

Useful variations:

• --tls-on-connect for implicit TLS, typically port 465.
• --auth LOGIN or other mechanisms, to test what the server accepts.
• --quit-after AUTH to test credentials without sending a message.
• --quit-after RCPT to test whether a recipient would be accepted, without sending data.

Pass passwords through environment variables rather than typing them on the command line, where they end up in shell history.

Testing headers and content#

swaks --server mail.example.com --port 587 --tls \
      --auth PLAIN --auth-user [email protected] --auth-password "$SMTP_PASSWORD" \
      --from [email protected] --to [email protected] \
      --header "Subject: Header test" \
      --header "List-Unsubscribe: <https://example.com/u/abc>" \
      --header "List-Unsubscribe-Post: List-Unsubscribe=One-Click" \
      --body @message-body.txt

--data @file.eml sends a complete prepared message, including your own headers and MIME structure, which is handy for reproducing a problem message exactly.

openssl s_client: seeing the TLS layer#

When the problem is TLS, such as certificate errors, protocol mismatches or STARTTLS failures, openssl s_client shows the handshake in detail.

STARTTLS on submission or relay ports#

openssl s_client -connect mail.example.com:587 -starttls smtp -servername mail.example.com

-starttls smtp makes openssl perform the plaintext EHLO and STARTTLS exchange before the handshake. The output shows the certificate chain, the negotiated protocol version and cipher, and verification results. Look for Verify return code: 0 (ok); anything else is a certificate problem.

Implicit TLS#

openssl s_client -connect mail.example.com:465 -servername mail.example.com

Checking an MX's inbound TLS#

dig +short MX example.net
openssl s_client -connect mx1.example.net:25 -starttls smtp -servername mx1.example.net </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

This prints the certificate's subject, issuer and validity dates, which is useful when checking MTA-STS readiness or investigating a TLS-RPT report.

After the handshake, s_client leaves you in an interactive session where you can type SMTP commands, but it does not handle authentication encoding for you. Use swaks for full transactions and openssl for TLS inspection.

openssl s_client -connect mail.example.com:587 -starttls smtp -tls1_2 </dev/null 2>/dev/null | grep -E "Protocol|Cipher"
openssl s_client -connect mail.example.com:587 -starttls smtp -tls1_3 </dev/null 2>/dev/null | grep -E "Protocol|Cipher"