How it works

Which port to use, and why it matters

Port 587 is the submission port: clients connect in plain text, say EHLO, and upgrade with STARTTLS before authenticating. Port 465 is implicit TLS — the connection is encrypted from the first byte — and after years of being deprecated it is standard again. Port 2525 is a convention some hosts use when 587 is blocked; it is only safe if STARTTLS is offered there. Port 25 is for servers talking to servers and should never carry a login; it is also the one port Cloudflare's edge cannot open, which is why this tool does not test it and the MX checker exists. For IMAP, 993 is implicit TLS and 143 is STARTTLS; Google and Microsoft only offer 993. A port that connects and accepts AUTH without ever offering TLS is a working configuration that leaks your password to every network between you and the server — the tool marks it NO TLS on purpose.

Reading the extensions

The EHLO response lists what the server supports. AUTH PLAIN LOGIN is password login; XOAUTH2 means the server prefers OAuth tokens — Google and Microsoft have been retiring password auth, so if XOAUTH2 is listed and PLAIN is not, an app password or OAuth connection is required. SIZE is the maximum message size, which decides whether that 12 MB deck attaches. PIPELINING and 8BITMIME are normal; their absence usually means a very old or very locked-down relay. SMTPUTF8 allows non-ASCII addresses. The software line is inferred from the greeting when it identifies itself — Postfix, Exim, Exchange, Sendmail — which is often the first clue about what kind of host you are looking at.

Cold email tools and custom SMTP

Instantly, Smartlead, lemlist and the rest all accept a custom SMTP and IMAP pair per inbox, which is how self-hosted mailboxes, cPanel accounts and private relays get into a sequence. Nearly every “inbox failed to connect” I get asked about is one of four things: the wrong port for the encryption setting, a host that only offers STARTTLS being configured as SSL/TLS (or vice versa), IMAP disabled on the account, or a provider that has turned off basic auth. Run the host here, read the recommendation box, and set the tool's fields to exactly that. If 587 and 465 both fail from the edge but work from your laptop, the server is allowlisting IPs — common on cPanel — and the tool's sending IPs need adding.

Limits

The test proves a session can be opened and authenticated in principle; it never logs in, so it cannot tell you a password is right or that the account is unlocked. It runs from Cloudflare's network, so a firewall that only accepts your office IP will show as a connection failure. Six checks per minute and sixty per day per visitor keeps the tool from being used as a scanner.

Frequently asked questions

Last reviewed September 16, 2026