How to Test an SMTP Server Before Configuring it in MagnusBilling

When email sending freezes or fails, the cause is often the path between the MagnusBilling server and the external SMTP provider. Test DNS, TCP, TLS and authentication from the server first so you can separate network restrictions from credential or application errors.

1. Check whether the SMTP port is open

Confirm the hostname and encryption mode with the provider. Common submission ports are 465 for implicit TLS, 587 for STARTTLS and, when offered by the provider, 2525 as an alternative.

A successful TCP connection confirms that the host and port are reachable. A timeout normally points to routing or firewall filtering; a refusal means the destination responded but no service accepted that connection.

465 — SSL/TLS
587 — STARTTLS
2525 — provider-specific alternative

nc -vz -w5 smtp.your-domain.example 465
nc -vz -w5 smtp.your-domain.example 587
nc -vz -w5 smtp.your-domain.example 2525

2. Test the TLS handshake

Port 465 starts inside TLS. Port 587 starts in clear text and upgrades with STARTTLS, so the OpenSSL commands are different.

Look for an SMTP banner beginning with 220.
Check the hostname and certificate chain.
A Verify return code: 0 (ok) result means OpenSSL accepted the chain on that server.

# Port 465: implicit TLS
openssl s_client -connect smtp.your-domain.example:465 -servername smtp.your-domain.example -crlf -quiet

# Port 587: STARTTLS
openssl s_client -starttls smtp -connect smtp.your-domain.example:587 -servername smtp.your-domain.example -crlf -quiet

3. Perform a complete authentication test with Swaks

Swaks exercises DNS, TCP, TLS, SMTP AUTH and message submission in one transaction. Replace every example value and use a dedicated test recipient. The --tls-on-connect option matches implicit TLS on port 465; use --tls on port 587.

apt update
apt install swaks -y

# Port 465
swaks --server smtp.your-domain.example --port 465 \
  --to recipient@example.net --from sender@your-domain.example \
  --auth LOGIN --auth-user sender@your-domain.example \
  --auth-password 'APPLICATION_PASSWORD' --tls-on-connect \
  --header 'Subject: MagnusBilling SMTP test' \
  --body 'SMTP test from the MagnusBilling server'

# For port 587, replace --tls-on-connect with --tls

4. Diagnose common failures

Outbound SMTP blocked: ask the datacenter to allow the exact destination and port, or use a provider-supported alternative such as 2525.
TLS failure: verify system time, DNS, SNI hostname and the CA bundle.
Authentication rejected: verify the complete username, password or application password and whether the From address must match the authenticated account.
Message accepted but not delivered: inspect the SMTP response, provider activity log, spam policy, SPF, DKIM and DMARC.

timedatectl status
apt update
apt install ca-certificates -y
update-ca-certificates

5. Configure MagnusBilling only after the tests pass

Enter the same hostname, port, encryption mode, username and sender identity that succeeded in the command-line test. Send a MagnusBilling test message and verify both the application log and the recipient mailbox.

Credential and test safety

Do not paste real SMTP passwords into tickets, screenshots or shell history.
Prefer an application password or dedicated SMTP account.
Remove test messages and rotate any credential exposed during troubleshooting.
Do not confuse a reachable port with successful authenticated delivery; complete the Swaks test.

Original article

This edition restores the complete connectivity, TLS, Swaks, troubleshooting and MagnusBilling configuration workflow from the archived guide.

Read the archived original article