Testing IMAP, POP3 and SMTP by hand with openssl s_client: a guide for technical users

E-mail·· 3 views· 4 min read

This article is for technical users with a command line (Linux, macOS, or Windows with OpenSSL). The short answer: openssl s_client opens an encrypted connection to the server and lets you type the protocol commands by hand. That separates a server problem from a program problem: if it works by hand, the server, the port and the password are right, and the fault is in the program settings.

The replies you will see

Protocol It worked It failed
IMAP (port 993) The line ends in OK, after the tag you typed (a1, a2...). NO (the server refused, the password for example) or BAD (the command is badly written).
POP3 (port 995) +OK -ERR, followed by the reason.
SMTP (port 465 or 587) 2xx codes (220 greeting, 235 authenticated, 250 accepted) and 354 (go ahead and type the message). 4xx temporary, 5xx final: 535 is a rejected password, 550 is a refused recipient or sender.

IMAP by hand

1 Connect. Use your own domain: openssl s_client -connect mail.yourdomain:993 -crlf -quiet The server answers with a line starting * OK.
2 See what the server can do, then log in. Every IMAP command starts with a tag of your choosing: a0 CAPABILITY
a1 LOGIN you@yourdomain "the-password" If the password has spaces or quotes, the simplest thing is to test with a temporary one.
3 List the folders and open the Inbox: a2 LIST "" "*"
a3 SELECT INBOX SELECT tells you how many messages there are (EXISTS).
4 Read the header of the first message without marking it as read (PEEK is what avoids the flag): a4 FETCH 1 (FLAGS BODY.PEEK[HEADER.FIELDS (FROM SUBJECT DATE)])
5 Leave: a5 LOGOUT

POP3 by hand

1 Connect and log in: openssl s_client -connect mail.yourdomain:995 -crlf -quiet
USER you@yourdomain
PASS the-password
2 Count and list the messages: STAT
LIST
UIDL STAT gives the number of messages and the total size; UIDL gives the unique identifier of each one, the same one your program uses to know what it already downloaded.
3 Leave with QUIT. Do not use DELE in a test: it marks the message for deletion, and QUIT deletes it for good.

SMTP by hand

1 Prepare the username and password in base64 (AUTH PLAIN format). read -s asks for the password without showing it or saving it in the history: read -s P
printf '\0%s\0%s' 'you@yourdomain' "$P" | base64
2 Connect. Over 465 (SSL/TLS) or 587 (STARTTLS): openssl s_client -connect mail.yourdomain:465 -crlf -quiet
openssl s_client -starttls smtp -connect mail.yourdomain:587 -crlf -quiet
3 Introduce yourself, log in and send to an address of your own: EHLO test
AUTH PLAIN the-base64-text-from-step-1
MAIL FROM:<you@yourdomain>
RCPT TO:<another-address-of-yours@example.com>
DATA
Subject: test by hand

This is a test.
.
QUIT The line holding a single dot ends the message; the server answers 250 and the message goes into the queue.
4 Read the EHLO reply: the list of 250 lines shows the extensions the server accepts (AUTH, SIZE, STARTTLS...). If AUTH is missing, the connection is not in the right mode to log in.
What you type stays on screen. The password shows in clear in the terminal window, and in SMTP it goes as base64, which is no encryption at all: anyone can decode it. Run these tests on your own computer, close the terminal afterwards, and never paste the output into a support ticket or a forum without removing the password and the AUTH line.
Without -quiet, s_client reads some letters as commands. A line starting with a capital R (such as RCPT TO) renegotiates the connection, and one starting with Q closes it. With -quiet that does not happen; alternatively, type the SMTP commands in lower case, which the protocol accepts.

The test by hand works but your program still fails? Tell us the program, the port and the error message, without the password.

Open a support ticket

SEE ALSO

SMTP ports 465, 587 and 25: SSL, STARTTLS and which one to use

Which ports are open, and why your integration hangs without an error

POP or IMAP: which to choose, and what you lose by picking wrong

IMAP folders, flags and IDLE: how push e-mail works and why a folder lags behind

How an e-mail travels: SMTP to the MX server, then IMAP or POP to the reader

Why your e-mail is not sending or receiving

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from 321,75 MT/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

E-mail 276 How to access your webmail You don't need to install anything to check your e-mail - the webmail works straight from your browser, on any device. A...
E-mail 332 How to set up your e-mail on Android Set your e-mail up once on Android and it keeps syncing in the background, on Wi-Fi or mobile data. Setting it up 1 Open...
E-mail 316 How to set up your e-mail on iPhone or iPad The Mail app on iPhone and iPad can hold your professional e-mail alongside any personal accounts, each syncing independ...
E-mail 286 How to set up your e-mail in Thunderbird Thunderbird can detect this server's settings automatically - you only need to type your name, e-mail and password. Auto...
E-mail 317 How to set up your e-mail in the new Outlook for Windows The new Outlook for Windows tries to configure itself automatically. If it can't, it falls back to the same manual setti...
E-mail 3 IMAP folders, flags and IDLE: how push e-mail works and why a folder lags behind The short answer: with IMAP the mail lives on the server, and what your program shows is a reflection of three things: t...