Rafael Pfister

SMTP-Tests

Erreichbarkeit, Banner, STARTTLS und Testmails.

Port erreichbar?

Prüft, ob der SMTP-Port (25, 587 oder 465) vom aktuellen Standort offen ist.

SMTP (25)

PowerShell (Windows)

Test-NetConnection Bordmittel 

Test-NetConnection -ComputerName mail.example.com -Port 25

nc / ncat Zusatztool 

ncat -vz mail.example.com 25

Unix-Shell (bash)

bash /dev/tcp Bordmittel 

timeout 5 bash -c "</dev/tcp/mail.example.com/25" && echo open || echo closed

nc Zusatztool 

nc -vz mail.example.com 25

Submission (587)

PowerShell (Windows)

Test-NetConnection Bordmittel 

Test-NetConnection -ComputerName mail.example.com -Port 587

nc / ncat Zusatztool 

ncat -vz mail.example.com 587

Unix-Shell (bash)

bash /dev/tcp Bordmittel 

timeout 5 bash -c "</dev/tcp/mail.example.com/587" && echo open || echo closed

nc Zusatztool 

nc -vz mail.example.com 587

SMTPS (465)

PowerShell (Windows)

Test-NetConnection Bordmittel 

Test-NetConnection -ComputerName mail.example.com -Port 465

nc / ncat Zusatztool 

ncat -vz mail.example.com 465

Unix-Shell (bash)

bash /dev/tcp Bordmittel 

timeout 5 bash -c "</dev/tcp/mail.example.com/465" && echo open || echo closed

nc Zusatztool 

nc -vz mail.example.com 465

Banner + EHLO

Öffnet die Verbindung, liest das 220-Banner und die EHLO-Antwort mit den angebotenen Fähigkeiten.

Eigener Mailserver

PowerShell (Windows)

TcpClient (.NET) Bordmittel 

$h = "mail.example.com"; $p = 25
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
Start-Sleep -Milliseconds 400; while ($c.Available) { $r.ReadLine() }
$w.WriteLine("EHLO test.example.com")
Start-Sleep -Milliseconds 400; while ($c.Available) { $r.ReadLine() }
$w.WriteLine("QUIT"); $c.Close()

nc / ncat Zusatztool 

"EHLO test.example.com`r`nQUIT`r`n" | ncat mail.example.com 25

Unix-Shell (bash)

bash /dev/tcp Bordmittel 

exec 3<>/dev/tcp/mail.example.com/25
printf 'EHLO test.example.com\r\nQUIT\r\n' >&3
cat <&3
exec 3<&-

nc Zusatztool 

( printf 'EHLO test.example.com\r\nQUIT\r\n'; sleep 1 ) | nc mail.example.com 25

Microsoft 365

PowerShell (Windows)

TcpClient (.NET) Bordmittel 

$h = "contoso-com.mail.protection.outlook.com"; $p = 25
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
Start-Sleep -Milliseconds 400; while ($c.Available) { $r.ReadLine() }
$w.WriteLine("EHLO test.example.com")
Start-Sleep -Milliseconds 400; while ($c.Available) { $r.ReadLine() }
$w.WriteLine("QUIT"); $c.Close()

nc / ncat Zusatztool 

"EHLO test.example.com`r`nQUIT`r`n" | ncat contoso-com.mail.protection.outlook.com 25

Unix-Shell (bash)

bash /dev/tcp Bordmittel 

exec 3<>/dev/tcp/contoso-com.mail.protection.outlook.com/25
printf 'EHLO test.example.com\r\nQUIT\r\n' >&3
cat <&3
exec 3<&-

nc Zusatztool 

( printf 'EHLO test.example.com\r\nQUIT\r\n'; sleep 1 ) | nc contoso-com.mail.protection.outlook.com 25

STARTTLS testen

Baut eine STARTTLS-Verbindung auf und zeigt das Zertifikat.

Submission (587)

PowerShell (Windows)

SslStream (.NET) Bordmittel 

$h = "mail.example.com"; $p = 587
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
$r.ReadLine() | Out-Null
$w.WriteLine("EHLO test.example.com"); Start-Sleep -Milliseconds 200; while ($c.Available) { $r.ReadLine() | Out-Null }
$w.WriteLine("STARTTLS"); $r.ReadLine()
$ssl = New-Object Net.Security.SslStream($s, $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotBefore, NotAfter
$ssl.Dispose(); $c.Close()

openssl Zusatztool 

openssl s_client -starttls smtp -crlf -connect mail.example.com:587 -servername mail.example.com

Unix-Shell (bash)

openssl Bordmittel 

openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

swaks Zusatztool 

swaks --server mail.example.com:587 -tls --quit-after TLS

Microsoft 365

PowerShell (Windows)

SslStream (.NET) Bordmittel 

$h = "smtp.office365.com"; $p = 587
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
$r.ReadLine() | Out-Null
$w.WriteLine("EHLO test.example.com"); Start-Sleep -Milliseconds 200; while ($c.Available) { $r.ReadLine() | Out-Null }
$w.WriteLine("STARTTLS"); $r.ReadLine()
$ssl = New-Object Net.Security.SslStream($s, $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotBefore, NotAfter
$ssl.Dispose(); $c.Close()

openssl Zusatztool 

openssl s_client -starttls smtp -crlf -connect smtp.office365.com:587 -servername smtp.office365.com

Unix-Shell (bash)

openssl Bordmittel 

openssl s_client -starttls smtp -connect smtp.office365.com:587 -servername smtp.office365.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

swaks Zusatztool 

swaks --server smtp.office365.com:587 -tls --quit-after TLS

Danach lässt sich manuell weiter tippen (EHLO, dann QUIT). openssl ist ein Zusatztool, unter Windows z. B. über Git für Windows vorhanden und läuft auch in PowerShell.

Implizites TLS (465)

Verbindet direkt verschlüsselt auf Port 465 (SMTPS, implizites TLS).

Impliztes TLS (465)

PowerShell (Windows)

SslStream (.NET) Bordmittel 

$h = "mail.example.com"; $p = 465
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotAfter
$ssl.Dispose(); $c.Close()

openssl Zusatztool 

openssl s_client -connect mail.example.com:465 -servername mail.example.com

Unix-Shell (bash)

openssl Bordmittel 

openssl s_client -connect mail.example.com:465 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

swaks Zusatztool 

swaks --server mail.example.com -p 465 --tlsc --quit-after BANNER

Testmail senden (SMTP-Stream)

Baut den kompletten SMTP-Dialog Zeile für Zeile auf (EHLO, MAIL FROM, RCPT TO, DATA, QUIT) und verschickt so eine echte Testnachricht: mit Bordmitteln, ohne Zusatztool.

PowerShell (Windows)

TcpClient (.NET) Bordmittel 

$h = "mail.example.com"; $p = 25
$from = "sender@example.com"; $to = "recipient@example.com"
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
function Talk($line) { if ($line) { $w.WriteLine($line) }; Start-Sleep -Milliseconds 300; while ($c.Available) { $r.ReadLine() } }
Talk $null
Talk "EHLO test.example.com"
Talk "MAIL FROM:<$from>"
Talk "RCPT TO:<$to>"
Talk "DATA"
$w.WriteLine("Subject: SMTP-Test")
$w.WriteLine("From: $from")
$w.WriteLine("To: $to")
$w.WriteLine("")
$w.WriteLine("Testnachricht via reinem SMTP-Stream.")
Talk "."
Talk "QUIT"
$c.Close()

Send-MailMessage Zusatztool 

Send-MailMessage -SmtpServer mail.example.com -Port 25 -From sender@example.com -To recipient@example.com -Subject "SMTP-Test" -Body "SMTP-Test $(Get-Date -Format o)"

Unix-Shell (bash)

bash /dev/tcp Bordmittel 

exec 3<>/dev/tcp/mail.example.com/25
send() { printf '%s\r\n' "$1" >&3; }
resp() { while IFS= read -r -t 3 line <&3; do printf '%s\n' "$line"; case $line in [0-9][0-9][0-9]" "*) break;; esac; done; }
resp
send "EHLO test.example.com"; resp
send "MAIL FROM:<sender@example.com>"; resp
send "RCPT TO:<recipient@example.com>"; resp
send "DATA"; resp
send "Subject: SMTP-Test"
send "From: sender@example.com"
send "To: recipient@example.com"
send ""
send "Testnachricht via reinem SMTP-Stream."
send "."; resp
send "QUIT"; resp
exec 3<&-

swaks Zusatztool 

swaks --server mail.example.com:25 --from sender@example.com --to recipient@example.com

Der Rohstrom läuft unverschlüsselt auf Port 25, passend für einen Relay oder den MX ohne Authentifizierung. Für Port 587 mit STARTTLS und AUTH eignen sich swaks oder openssl. Send-MailMessage gilt offiziell als veraltet, funktioniert aber weiterhin.

Weitere Bereiche