Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for some advice, what I should to check at my brand new mail-server for it's correct behavior. /saying behavior, because it is working - just but want be sure than it is working correctly./

I don't want get blacklisted only because, for example I forgot disallow plaintext auth.

Want use swaks for verifying functionality "from the internet side".

As first comes to my mind:

  1. open relay - should be not allowed
  2. as I say above - disallowed plain text auth - allow only over tls.
  3. try deliver to nonexistent local user - should fail
  4. verify delivery (existence) of the postmaster and abuse aliases (some other is recommented to have?)


swaks --to .. --from .. --auth-user name --auth-password pass --protocol SMTP

If this fails, with the message *** Host did not advertise authentication is enough OK for the 2.?

Any other ideas what I must/should verify? The swaks is great tool - if you know how to use it :) Using "exim" as MTA. What is your favorite swaks tip?

share|improve this question
up vote 2 down vote accepted

Your example is not sufficient to show that plaintext auth isn't allowed over non-tls connections. --protocol SMTP is explicitly telling swaks NOT to use ESMTP, and ESMTP is required for authentication. In other words, you're testing that auth isn't offered over SMTP, not that plaintext auth isn't offered over plaintext connections. (who's on first!).

The following is closer to what you're looking for:

# These should fail, because you don't want to offer plaintext auth protocols
# over non-tls connections
swaks ... --auth PLAIN --auth-user .. --auth-password ..
swaks ... --auth LOGIN --auth-user .. --auth-password ..

# Should succeed because hashed PW protocols are ok over plaintext (assuming you
# support them at all of course):
swaks ... --auth CRAM-MD5 --auth-user .. --auth-password ..
swaks ... --auth DIGEST-MD5 --auth-user .. --auth-password ..
swaks ... --auth NTLM --auth-user .. --auth-password ..

# The converse of the above, make sure your plaintext password work over tls
# sessions (assuming you want them to, of course)
swaks ... --auth PLAIN --auth-user .. --auth-password .. --tls
swaks ... --auth LOGIN --auth-user .. --auth-password .. --tls
swaks ... --auth CRAM-MD5 --auth-user .. --auth-password .. --tls
swaks ... --auth DIGEST-MD5 --auth-user .. --auth-password .. --tls
swaks ... --auth NTLM --auth-user .. --auth-password .. --tls

Hope that helps, good luck!

share|improve this answer
thank you very much. :) – kobame Apr 27 '13 at 0:21
I think we want the first two to fail but you have written "should succeed". – joeytwiddle May 12 at 13:31

Test for open relay:

$ swaks -f -t --server

Test for nonexistent user delivery

$ swaks -f -t --server

You should verify all email ports (25,465, 587) for correctness, maybe someone will suggest more tests how to do.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.