No. The test ends the session after EHLO and STARTTLS with QUIT. There is no MAIL FROM, no RCPT TO and no DATA, so no delivered message and no open relay test.

How is the certificate checked?

The TLS connection is built with verification: the chain must lead to a public CA, the MX host name must be covered and the certificate must be valid. If that fails, the reason is shown (self-signed, unknown CA, host name does not match, expired). Without MTA-STS or DANE this is only a note on port 25.

My mail server does not respond, what could be the cause?

The firewall blocks inbound port 25, the MTA listens on a different port or not at all, or the MX record points to a host without a running mail server. The MX Lookup shows which host the SMTP Test contacts at all.

What does it mean if port 25 is blocked?

No connection on port 25 is established between the test source and the target server. Outbound, many providers block port 25 against spam; inbound, a restrictive firewall on the target server. To accept email, port 25 must be open inbound.

Why does the test take a moment?

Each MX host is contacted one after another with real network timeouts, including the TLS handshake. The test runs in the background, the result appears automatically once all hosts are done.

Why is a host skipped as a 'cooldown'?

So the same target IP is not contacted every minute (protection against false alarms and rate limits on the target servers), a short lockout applies per target IP between two tests.

SMTP Test

Connects to a domain's MX servers and checks port 25, EHLO and STARTTLS.

The SMTP Test connects to a domain's mail servers the way a delivering mail server would, and checks whether accepting email works technically: reachability on port 25, the greeting banner, the ESMTP capabilities and an encrypted connection via STARTTLS. It answers questions like does our server accept connections at all and is transport encryption set up cleanly.

What this tool checks

It resolves the domain's MX hosts and contacts them one after another on port 25. For each host it measures the time to the TCP connection and to the 220 banner, sends EHLO with a fixed HELO name and lists the offered capabilities (STARTTLS, SIZE, PIPELINING, 8BITMIME, AUTH and others). If the server offers STARTTLS, it switches to TLS and checks: the negotiated TLS version and cipher suite, and the server certificate against the public CAs (chain, covered host name, validity, issuer, key length, self-signed). A second EHLO over the encrypted connection and QUIT follow.

Reading the result

Green means: host reachable, banner clean, STARTTLS offered and a trusted, valid certificate. On port 25 encryption is opportunistic, so a self-signed or untrusted certificate is only a note here, not an error, as long as MTA-STS or DANE do not require it; an expired certificate is a warning. No STARTTLS on offer is a warning, an unreachable host or a missing banner an error. If a host is skipped as a cooldown, the same target IP was tested recently.

Background

The protocol flow follows RFC 5321 (SMTP, EHLO, response codes, implicit MX). STARTTLS on port 25 is described in RFC 3207, the capabilities SIZE in RFC 1870 and PIPELINING in RFC 2920. Mandatory transport encryption does not come from SMTP itself but only from MTA-STS (RFC 8461) or DANE (RFC 7672). Deliberately not sent are MAIL FROM, RCPT TO and DATA: no test mail, no open relay test.

Common problems and how to fix them

Host not reachable on port 25. Either the firewall blocks inbound, the service is not listening, or the MX points to the wrong host. On the target server check that the MTA is bound to port 25, and open the inbound firewall for port 25.
No STARTTLS on offer. The server accepts mail only unencrypted. Set a certificate in the MTA and enable STARTTLS; without it, MTA-STS and DANE fail on the other side.
Certificate not trusted or host name does not match. Usually the intermediate certificate is missing from the chain or the MX host name is not a SAN in the certificate. Use a certificate that covers all MX names and serve the full chain. Important once MTA-STS runs in enforce mode.
Very slow banner. Often a greylisting or reverse DNS lookup with a timeout on the other side. For your own server, make sure the IP has valid, forward-confirmed reverse DNS (FCrDNS).
Port 25 does not work outbound from your own network. Many providers and hosts block outbound port 25. That is a property of the test network, not a fault of the checked domain; the test here runs from a network with port 25 allowed.

Common questions

Is a test mail sent?: No. The test ends the session after EHLO and STARTTLS with QUIT. There is no MAIL FROM, no RCPT TO and no DATA, so no delivered message and no open relay test.
How is the certificate checked?: The TLS connection is built with verification: the chain must lead to a public CA, the MX host name must be covered and the certificate must be valid. If that fails, the reason is shown (self-signed, unknown CA, host name does not match, expired). Without MTA-STS or DANE this is only a note on port 25.
My mail server does not respond, what could be the cause?: The firewall blocks inbound port 25, the MTA listens on a different port or not at all, or the MX record points to a host without a running mail server. The MX Lookup shows which host the SMTP Test contacts at all.
What does it mean if port 25 is blocked?: No connection on port 25 is established between the test source and the target server. Outbound, many providers block port 25 against spam; inbound, a restrictive firewall on the target server. To accept email, port 25 must be open inbound.
Why does the test take a moment?: Each MX host is contacted one after another with real network timeouts, including the TLS handshake. The test runs in the background, the result appears automatically once all hosts are done.
Why is a host skipped as a 'cooldown'?: So the same target IP is not contacted every minute (protection against false alarms and rate limits on the target servers), a short lockout applies per target IP between two tests.