SMTP connectivity

This opens a TCP connection to port 25 on an address of each MX host and reads the greeting. The SMTP probe is the only part of the mail section that talks to the server rather than about it — this check, the STARTTLS check and the certificate check all read from the one conversation — and this one is what separates an MX record that points somewhere from an MX record that points at something which accepts mail.

There are three outcomes, graded differently. A connection that opens and greets with a 220 passes. A server answering with a 4xx or 5xx greeting, or dropping the connection immediately, is a failure: senders retry for a few days and then bounce, and until they do the mail is invisible at both ends. A connection that never opens is unknown, not a failure — most VPS providers block outbound port 25 by default to limit spam, so silence here is more often our network than yours.

The probe never sends MAIL FROM or RCPT TO. It connects, reads the banner, sends EHLO and quits. This is a capability probe and not a mailbox validator, and it must never become one — which also means it cannot tell you whether any given address would be accepted.

A slow greeting is worth noticing rather than worrying about. Deliberate delays are a common anti-spam technique, and a server taking several seconds to say hello is usually tarpitting on purpose.

A domain with a null MX (RFC 7505 0 .) gets no row here at all, rather than an unknown one. unknown means we could not measure something that exists; a null MX says in the domain's own zone that there is no mail server, so there is nothing to measure and nothing to report.

For a rejected greeting, read the code. A 421 at connect is usually load shedding or a connection limit; a 554 is generally a reputation-based block applied to the connecting address before any conversation happens. Both are the receiving server's own policy, and both are configured somewhere you control if the server is yours.

For a connection that will not open, check the listener and the firewall on the MX addresses themselves — and check that the MX record points where you think it does. If a filtering provider sits in front of your mail, the MX should be theirs, and one still pointing at the origin bypasses the filtering entirely.

Verify it yourself with openssl s_client -starttls smtp -connect mx.example.com:25, which does the connection, the greeting and the TLS negotiation in one step. From a network that blocks port 25 outbound, nothing you test locally will tell you anything.