SMTP handshakes with swaks
Inspect a server greeting and capabilities without submitting a message.
Prerequisites and scope
Use an installed swaks client from a terminal authorized to connect to the server. Enter an actual server, port and EHLO hostname belonging to your sending system. Local firewalls and hosting restrictions can prevent outbound SMTP. These checks stop before MAIL FROM, RCPT TO and DATA.
Inspect ESMTP capabilities
read -r -p "Authorized SMTP server hostname: " smtp_host
read -r -p "SMTP port: " smtp_port
read -r -p "Your sending system EHLO hostname: " ehlo_name
swaks --config --server "$smtp_host" --port "$smtp_port" \
--helo "$ehlo_name" --quit-after HELO --timeout 30sNegotiate STARTTLS
read -r -p "Authorized STARTTLS SMTP hostname: " smtp_host
read -r -p "STARTTLS SMTP port: " smtp_port
read -r -p "Your sending system EHLO hostname: " ehlo_name
swaks --config --server "$smtp_host" --port "$smtp_port" \
--helo "$ehlo_name" --tls --quit-after TLS --timeout 30sThe TLS stop point ends after negotiation. Do not use this STARTTLS command for an implicit-TLS endpoint. The --config option disables configuration files; inherited SWAKS_OPT environment settings can still affect behavior, so use a controlled terminal environment.
What to retain
| Evidence | Meaning |
|---|---|
| Connection error | Investigate resolution, routing, firewall and server availability. |
| SMTP greeting and EHLO response | Shows the endpoint reached and the capabilities it advertises. |
| TLS negotiation result | Shows whether that connection negotiated TLS; use certificate verification for identity checks. |
A successful handshake does not establish sender authentication, recipient acceptance or inbox placement. Use OpenSSL certificate verification for explicit hostname and trust checks. Do not remove the stop point unless you intend to perform an authorized message submission.