Monitor types
Mail server monitors (SMTP, IMAP, POP3)
Check that SMTP, IMAP and POP3 servers answer, offer STARTTLS or TLS and present a valid certificate, without FastPing ever logging in or sending mail.
- API type
smtp·imap·pop3- You enter
- Hostname or IP
- Default port
- 25 · 993 · 995
- Runs at most every
- 5 minutes
- Needs
- None
A mail server monitor holds the same opening conversation as a mail client or another mail server, then ends it politely:
- FastPing connects and reads the server's greeting.
- It asks for the server's capabilities:
EHLOfor SMTP,CAPABILITYfor IMAP,CAPAfor POP3. - When the server offers it, the connection is upgraded with
STARTTLS(STLSfor POP3). On the implicit-TLS ports 465, 993 and 995 the connection is encrypted from the first byte instead. - The certificate is validated and the capabilities are read again over TLS.
- FastPing says goodbye with
QUITorLOGOUT.
FastPing never authenticates and never sends a message, so no credentials are needed and nothing reaches any mailbox. In EHLO it introduces itself as direct.fastping.app. The check runs at most every 5 minutes.
| Type | Port | Used for |
|---|---|---|
| SMTP server | 25 | Receiving mail from other servers (your MX hosts). Encryption with STARTTLS. |
| SMTP server | 587 | Submission: your users' mail clients sending mail, with STARTTLS. |
| SMTP server | 465 | Submission with TLS from the first byte. |
| IMAP server | 993 / 143 | Reading mail: TLS from the first byte on 993, STARTTLS on 143. |
| POP3 server | 995 / 110 | Downloading mail: TLS from the first byte on 995, STLS on 110. |
When you leave the port empty, the defaults are 25 for SMTP, 993 for IMAP and 995 for POP3.
- Automatic (default): uses STARTTLS when the server offers it, and TLS from the first byte on 465, 993 and 995.
- Require STARTTLS: the monitor goes down when the server does not offer STARTTLS.
- Implicit TLS: TLS from the first byte, whatever the port.
- None: only the greeting is checked, without encryption.
Down: no session at all (connection refused or timed out, an error greeting, a failed TLS handshake on an implicit-TLS port); STARTTLS missing when you require it; a certificate that is untrusted, expired or does not match the host name (while certificate alerts are on); or a greeting that does not contain your "Must contain" text.
Warning: STARTTLS not offered on a client port such as 587, 143 or 110 in automatic mode, because logins would travel unencrypted; a certificate that expires within your warning period (14 days by default); a greeting slower than your threshold.
SMTP on port 25 in automatic mode is treated more gently. Mail servers usually encrypt port-25 traffic opportunistically and deliver even when the certificate cannot be verified, unless the receiving domain publishes MTA-STS or DANE. So on port 25, a missing STARTTLS is only noted and certificate problems give a warning instead of an outage. Choose Require STARTTLS if you want strict rules there too.
| Field | API option | Default | Notes |
|---|---|---|---|
| Hostname, domain or IP | host | Required | For example mail.example.com |
| Port | port | 25 | 25 for MX servers, 587 for submission (STARTTLS), 465 for implicit TLS. |
| Encryption | mailTls | Automatic (by port) | One of: Automatic (by port) (auto), Require STARTTLS (starttls), Implicit TLS (TLS from the first byte) (tls), None: check the greeting only (none). Automatic: implicit TLS on ports 465, 993 and 995, and STARTTLS on other ports when the server offers it. |
| Warn when the certificate expires within (days) | certWarnDays | 14 | 1 to 120 |
| Must contain (optional) | expected | None | Up to 300 characters |
| Timeout (seconds) | timeout | 20 | 2 to 60 |
| Warn if slower than (ms) | maxMs | None | 0 to 60,000 |
| Alert on an untrusted, expired or mismatched certificate | verifyCert | On | |
| Check interval | interval | Your plan's minimum | Never more often than every 5 minutes |
The three mail types share these settings; only the default port differs. "Must contain" is matched against the server's greeting, for example your host name.
| Message | What it means | What to do |
|---|---|---|
Connection refused (nothing listens on this port) | The host answered but no mail service listens on that port. | Check the port and that the mail service is running. |
Timed out connecting (the port may be filtered by a firewall) | No answer to the connection attempt. | Many hosting and cloud providers block port 25; check firewalls and provider rules. |
The server refused the session: 554 … | The server answered with an error greeting, often because of a blocklist, rate limit or connection policy. | Read the server's message and its logs; allowlist FastPing if needed. |
STARTTLS not offered | The server does not advertise STARTTLS while you require it. | Enable TLS in the mail server configuration. |
TLS handshake timed out | The TLS negotiation did not finish in time. | Check the TLS configuration and that the port really speaks TLS. |
Invalid certificate: … | The certificate is untrusted, expired or issued for another name. | Install a publicly trusted certificate that covers the host name clients use. |
Greeting does not contain "mail.example.com" | Your "Must contain" text is not in the greeting. | Check the greeting, or update the expected text. |
The free Mail server test runs the same conversation once and shows the transcript, so you can see where a server stops.
For the SPF, DKIM and DMARC records of your domain, use an email security monitor; for blocklists, a blacklist monitor.