How to read an SMTP session log

An SMTP session

Understanding the inner workings of email delivery can be very useful for troubleshooting failed transmission of your emails. One essential aspect of email delivery is the Simple Mail Transfer Protocol (SMTP), which is the primary protocol used for sending emails across the internet. Diving deeper into this process, we’ll take a look at how to read an SMTP session log. By understanding these logs, you will be better equipped to diagnose and resolve potential email delivery issues.

There are WordPress mail-related plugins which support logging SMTP sessions, so this guide might come in handy as you’re using those.

What is an SMTP session?

An SMTP (Simple Mail Transfer Protocol) session is a plain-text communication process between two participants: the client, which is typically an email client or application, and the server, which is responsible for handling and delivering emails. The session operates through a series of back-and-forth commands and responses exchanged between the client and the server, making it easy to read and troubleshoot.

The process begins with the establishment of a connection between the client and the server. The client initiates the connection by sending an EHLO command, and the server responds with its capabilities. The client then proceeds to authenticate itself if necessary, provide the email’s sender and recipient information, and transmit the email content. The server acknowledges each command with appropriate response codes and messages, indicating the success or failure of each step.

Have a WordPress email problem right now? Ask us about it.

We’ll attempt to publish a solution ASAP for free. Challenge us!

So we can notify you when we publish a solution

During the entire SMTP session, both the client and the server exchange information in a human-readable, plain-text format. While this makes it easy to understand and debug issues, it can also pose security risks, as the contents of the communication are not encrypted by default. To address this, many SMTP servers support the STARTTLS command, which allows the client and server to upgrade their plain-text connection to an encrypted one, ensuring the confidentiality and integrity of the email data being transmitted.

Analyzing an SMTP session

Below is a full SMTP session log that ends up successfully sending an email. In the left column are the different log entries, while the right column shows an explanation.

2023-04-11 10:49:15 Connection: opening to smtp.speedymx.com:587, timeout=300, options=array()
2023-04-11 10:49:15 Connection: opened
2023-04-11 10:49:15 SMTP INBOUND: "220 smtp.speedymx.com Welcome to SpeedyMX mail server v3. - SpeedyMX"
2023-04-11 10:49:15 SERVER -> CLIENT: 220 smtp.speedymx.com Welcome to SpeedyMX mail server v3. - SpeedyMX
2023-04-11 10:49:15 CLIENT -> SERVER: EHLO lab.nanopo.st
2023-04-11 10:49:15 SMTP INBOUND: "250-smtp.speedymx.com"
2023-04-11 10:49:15 SMTP INBOUND: "250-8BITMIME"
2023-04-11 10:49:15 SMTP INBOUND: "250-SMTPUTF8"
2023-04-11 10:49:15 SMTP INBOUND: "250-STARTTLS"
2023-04-11 10:49:15 SMTP INBOUND: "250-HELP"
2023-04-11 10:49:15 SMTP INBOUND: "250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. - SpeedyMX"
2023-04-11 10:49:15 SERVER -> CLIENT: 250-smtp.speedymx.com250-8BITMIME250-SMTPUTF8250-STARTTLS250-HELP250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. - SpeedyMX
2023-04-11 10:49:15 CLIENT -> SERVER: STARTTLS
2023-04-11 10:49:15 SMTP INBOUND: "220 Ready to start TLS - SpeedyMX"
2023-04-11 10:49:15 SERVER -> CLIENT: 220 Ready to start TLS - SpeedyMX
2023-04-11 10:49:15 CLIENT -> SERVER: EHLO lab.nanopo.st
2023-04-11 10:49:15 SMTP INBOUND: "250-smtp.speedymx.com"
2023-04-11 10:49:15 SMTP INBOUND: "250-8BITMIME"
2023-04-11 10:49:15 SMTP INBOUND: "250-SMTPUTF8"
2023-04-11 10:49:15 SMTP INBOUND: "250-AUTH LOGIN PLAIN"
2023-04-11 10:49:15 SMTP INBOUND: "250-HELP"
2023-04-11 10:49:15 SMTP INBOUND: "250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. - SpeedyMX"
2023-04-11 10:49:15 SERVER -> CLIENT: 250-smtp.speedymx.com250-8BITMIME250-SMTPUTF8250-AUTH LOGIN PLAIN250-HELP250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. - SpeedyMX
2023-04-11 10:49:15 Auth method requested: UNSPECIFIED
2023-04-11 10:49:15 Auth methods available on the server: LOGIN,PLAIN
2023-04-11 10:49:15 Requested auth method not available:
2023-04-11 10:49:15 Auth method selected: LOGIN
2023-04-11 10:49:15 CLIENT -> SERVER: AUTH LOGIN
2023-04-11 10:49:15 SMTP INBOUND: "334 VXNlcm5hbWU6"
2023-04-11 10:49:15 SERVER -> CLIENT: 334 VXNlcm5hbWU6
2023-04-11 10:49:15 CLIENT -> SERVER: bGFiQG5hbm9wby5zdA==
2023-04-11 10:49:15 SMTP INBOUND: "334 UGFzc3dvcmQ6"
2023-04-11 10:49:15 SERVER -> CLIENT: 334 UGFzc3dvcmQ6
2023-04-11 10:49:15 CLIENT -> SERVER: UDZsTjhHNTNHUGpM
2023-04-11 10:49:16 SMTP INBOUND: "235 2.7.0 Authentication successful - SpeedyMX"
2023-04-11 10:49:16 SERVER -> CLIENT: 235 2.7.0 Authentication successful - SpeedyMX
2023-04-11 10:49:16 CLIENT -> SERVER: MAIL FROM:<[email protected]>
2023-04-11 10:49:16 SMTP INBOUND: "250 OK - SpeedyMX"
2023-04-11 10:49:16 SERVER -> CLIENT: 250 OK - SpeedyMX
2023-04-11 10:49:16 CLIENT -> SERVER: RCPT TO:<[email protected]>
2023-04-11 10:49:16 SMTP INBOUND: "250 2.0.0 Recipient accepted. - SpeedyMX"
2023-04-11 10:49:16 SERVER -> CLIENT: 250 2.0.0 Recipient accepted. - SpeedyMX
2023-04-11 10:49:16 CLIENT -> SERVER: DATA
2023-04-11 10:49:16 SMTP INBOUND: "354 End data with <CR><LF>.<CR><LF> - SpeedyMX"
2023-04-11 10:49:16 SERVER -> CLIENT: 354 End data with <CR><LF>.<CR><LF> - SpeedyMX
2023-04-11 10:49:16 CLIENT -> SERVER: Date: Tue, 11 Apr 2023 10:49:15 +0000
2023-04-11 10:49:16 CLIENT -> SERVER: To: [email protected]
2023-04-11 10:49:16 CLIENT -> SERVER: From: nanoPost Lab <[email protected]>
2023-04-11 10:49:16 CLIENT -> SERVER: Subject: Test email
2023-04-11 10:49:16 CLIENT -> SERVER: Message-ID: <[email protected]>
2023-04-11 10:49:16 CLIENT -> SERVER: X-Mailer: PHPMailer 6.7 (https://github.com/PHPMailer/PHPMailer)
2023-04-11 10:49:16 CLIENT -> SERVER: MIME-Version: 1.0
2023-04-11 10:49:16 CLIENT -> SERVER: Content-Type: text/plain; charset=UTF-8
2023-04-11 10:49:16 CLIENT -> SERVER:
2023-04-11 10:49:16 CLIENT -> SERVER: Test email
2023-04-11 10:49:16 CLIENT -> SERVER:
2023-04-11 10:49:16 CLIENT -> SERVER: .
2023-04-11 10:49:16 SMTP INBOUND: "250 2.0.0 Email queued for delivery. - SpeedyMX"
2023-04-11 10:49:16 SERVER -> CLIENT: 250 2.0.0 Email queued for delivery. - SpeedyMX
2023-04-11 10:49:16 CLIENT -> SERVER: QUIT
2023-04-11 10:49:16 SMTP INBOUND: "221 Bye - SpeedyMX"
2023-04-11 10:49:16 SERVER -> CLIENT: 221 Bye - SpeedyMX
2023-04-11 10:49:16 Connection: closed
 
SMTP Log EntryExplanation
2023-04-11 10:49:15 Connection: opening to smtp.speedymx.com:587, timeout=300, options=array()

2023-04-11 10:49:15 Connection: opened

2023-04-11 10:49:15 SMTP INBOUND: “220 smtp.speedymx.com Welcome to SpeedyMX mail server v3. – SpeedyMX”

2023-04-11 10:49:15 SERVER -> CLIENT: 220 smtp.speedymx.com Welcome to SpeedyMX mail server v3. – SpeedyMX
Connection establishment: The session begins with a connection attempt to smtp.speedymx.com on port 587. The connection is successfully opened, and the server sends a welcome message.
2023-04-11 10:49:15 CLIENT -> SERVER: EHLO lab.nanopo.stEHLO command: The client sends an EHLO command to identify itself (lab.nanopo.st) to the server (smtp.speedymx.com). The server responds with a list of supported features, including 8BITMIME, SMTPUTF8, STARTTLS, and HELP.

Issue: If the server does not respond or responds with an error, the connection might be rejected, or the client may need to use a different identification method like HELO.
2023-04-11 10:49:15 SMTP INBOUND: “250-smtp.speedymx.com”

2023-04-11 10:49:15 SMTP INBOUND: “250-8BITMIME”

2023-04-11 10:49:15 SMTP INBOUND: “250-SMTPUTF8”

2023-04-11 10:49:15 SMTP INBOUND: “250-STARTTLS”

2023-04-11 10:49:15 SMTP INBOUND: “250-HELP”

2023-04-11 10:49:15 SMTP INBOUND: “250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. – SpeedyMX”
The server responds with a list of supported features, including 8BITMIME, SMTPUTF8, STARTTLS, and HELP.

Note: If the server does not respond or responds with an error, the connection might be rejected, or the client may need to use a different identification method like HELO.
2023-04-11 10:49:15 CLIENT -> SERVER: STARTTLSSTARTTLS command: The client sends a STARTTLS command to initiate a secure connection.
2023-04-11 10:49:15 SMTP INBOUND: “220 Ready to start TLS – SpeedyMX”2023-04-11 10:49:15 SERVER -> CLIENT: 220 Ready to start TLS – SpeedyMXThe server acknowledges this request and is ready to begin TLS.
Note: If the server does not support TLS or there is a problem with the TLS handshake, the secure connection might fail, leading to email transmission issues.
2023-04-11 10:49:15 CLIENT -> SERVER: EHLO lab.nanopo.stEHLO command again: The client sends another EHLO command after establishing the secure connection to re-negotiate the supported features. 
2023-04-11 10:49:15 SMTP INBOUND: “250-smtp.speedymx.com”

2023-04-11 10:49:15 SMTP INBOUND: “250-8BITMIME”

2023-04-11 10:49:15 SMTP INBOUND: “250-SMTPUTF8”

2023-04-11 10:49:15 SMTP INBOUND: “250-AUTH LOGIN PLAIN”

2023-04-11 10:49:15 SMTP INBOUND: “250-HELP”

2023-04-11 10:49:15 SMTP INBOUND: “250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. – SpeedyMX”
The server responds with a new list of supported features, including AUTH LOGIN and PLAIN.
2023-04-11 10:49:15 Auth method requested: UNSPECIFIED

2023-04-11 10:49:15 Auth methods available on the server: LOGIN,PLAIN

2023-04-11 10:49:15 Requested auth method not available:

2023-04-11 10:49:15 Auth method selected: LOGIN
Client and server agree on the authentication method (LOGIN)
2023-04-11 10:49:15 CLIENT -> SERVER: AUTH LOGINClient initiates authentication process
2023-04-11 10:49:15 SMTP INBOUND: “334 VXNlcm5hbWU6”

2023-04-11 10:49:15 SERVER -> CLIENT: 334 VXNlcm5hbWU6
Server requests username (base64-encoded)
2023-04-11 10:49:15 CLIENT -> SERVER: bGFiQG5hbm9wby5zdA==Client sends base64-encoded username
2023-04-11 10:49:15 SMTP INBOUND: “334 UGFzc3dvcmQ6”

2023-04-11 10:49:15 SERVER -> CLIENT: 334 UGFzc3dvcmQ6
Server requests password (base64-encoded)
2023-04-11 10:49:15 CLIENT -> SERVER: dGhpczE1bXlwNHNzdzByZA==Client sends base64-encoded password
2023-04-11 10:49:16 SMTP INBOUND: “235 2.7.0 Authentication successful – SpeedyMX”

2023-04-11 10:49:16 SERVER -> CLIENT: 235 2.7.0 Authentication successful – SpeedyMX
Server confirms successful authentication
Note: If the provided credentials are incorrect or the authentication method is not supported, the server may reject the connection or require a different authentication method.
2023-04-11 10:49:16 CLIENT -> SERVER: MAIL FROM:[email protected]MAIL FROM command: The client sends the MAIL FROM command, specifying the sender’s email address ([email protected]). 
2023-04-11 10:49:16 SMTP INBOUND: “250 OK – SpeedyMX”

2023-04-11 10:49:16 SERVER -> CLIENT: 250 OK – SpeedyMX
Server confirms sender acceptance
2023-04-11 10:49:16 CLIENT -> SERVER: RCPT TO:[email protected]RCPT TO command: The client specifies the recipient’s email address ([email protected]). 
2023-04-11 10:49:16 SMTP INBOUND: “250 2.0.0 Recipient accepted. – SpeedyMX”

2023-04-11 10:49:16 SERVER -> CLIENT: 250 2.0.0 Recipient accepted. – SpeedyMX
Server confirms recipient acceptance.
Note: If the recipient’s email address is invalid or the server rejects it, the email cannot be sent.
2023-04-11 10:49:16 CLIENT -> SERVER: DATADATA command:: The client sends the DATA command to signal that it is ready to send the email content.
2023-04-11 10:49:16 SMTP INBOUND: “354 End data with <CR><LF>.<CR><LF> – SpeedyMX”

2023-04-11 10:49:16 SERVER -> CLIENT: 354 End data with <CR><LF>.<CR><LF> – SpeedyMX
Server acknowledges and prepares to receive email data
2023-04-11 10:49:16 CLIENT -> SERVER: (email content, including headers, body, and attachments)Email content transmission: The client sends the email content, including headers and body, line by line. 
2023-04-11 10:49:16 CLIENT -> SERVER: .Client signals the end of the email data with a single period (.)
2023-04-11 10:49:16 SMTP INBOUND: “250 2.0.0 OK: queued as 1234567890ABCDEF – SpeedyMX”

2023-04-11 10:49:16 SERVER -> CLIENT: 250 2.0.0 OK: queued as 1234567890ABCDEF – SpeedyMX
Email queued for delivery: The server responds with a 250 status code, indicating that the email has been successfully queued for delivery.Note: If the message format is incorrect or the server encounters an issue processing the message, it may reject the email or send an error response.
2023-04-11 10:49:16 CLIENT -> SERVER: QUITQUIT command: The client sends a QUIT command to terminate the session
2023-04-11 10:49:16 SMTP INBOUND: “221 2.0.0 Bye – SpeedyMX”

2023-04-11 10:49:16 SERVER -> CLIENT: 221 2.0.0 Bye – SpeedyMX
Server acknowledges the QUIT command and ends the SMTP session
2023-04-11 10:49:16 Connection: closedConnection between client and server is closed

Leave a Reply

Your email address will not be published. Required fields are marked *