How to read an SMTP session log
Understanding the inner workings of email delivery can be very useful for troubleshooting failed transmission of your emails. One essential aspect of email delivery is the Simple Mail Transfer Protocol (SMTP), which is the primary protocol used for sending emails across the internet. Diving deeper into this process, we’ll take a look at how to read an SMTP session log. By understanding these logs, you will be better equipped to diagnose and resolve potential email delivery issues.
There are WordPress mail-related plugins which support logging SMTP sessions, so this guide might come in handy as you’re using those.
What is an SMTP session?
An SMTP (Simple Mail Transfer Protocol) session is a plain-text communication process between two participants: the client, which is typically an email client or application, and the server, which is responsible for handling and delivering emails. The session operates through a series of back-and-forth commands and responses exchanged between the client and the server, making it easy to read and troubleshoot.
The process begins with the establishment of a connection between the client and the server. The client initiates the connection by sending an EHLO command, and the server responds with its capabilities. The client then proceeds to authenticate itself if necessary, provide the email’s sender and recipient information, and transmit the email content. The server acknowledges each command with appropriate response codes and messages, indicating the success or failure of each step.
Have a WordPress email problem right now? Ask us about it.
We’ll attempt to publish a solution ASAP for free. Challenge us!
During the entire SMTP session, both the client and the server exchange information in a human-readable, plain-text format. While this makes it easy to understand and debug issues, it can also pose security risks, as the contents of the communication are not encrypted by default. To address this, many SMTP servers support the STARTTLS command, which allows the client and server to upgrade their plain-text connection to an encrypted one, ensuring the confidentiality and integrity of the email data being transmitted.
Analyzing an SMTP session
Below is a full SMTP session log that ends up successfully sending an email. In the left column are the different log entries, while the right column shows an explanation.
| SMTP Log Entry | Explanation |
| 2023-04-11 10:49:15 Connection: opening to smtp.speedymx.com:587, timeout=300, options=array() 2023-04-11 10:49:15 Connection: opened 2023-04-11 10:49:15 SMTP INBOUND: “220 smtp.speedymx.com Welcome to SpeedyMX mail server v3. – SpeedyMX” 2023-04-11 10:49:15 SERVER -> CLIENT: 220 smtp.speedymx.com Welcome to SpeedyMX mail server v3. – SpeedyMX | Connection establishment: The session begins with a connection attempt to smtp.speedymx.com on port 587. The connection is successfully opened, and the server sends a welcome message. |
| 2023-04-11 10:49:15 CLIENT -> SERVER: EHLO lab.nanopo.st | EHLO command: The client sends an EHLO command to identify itself (lab.nanopo.st) to the server (smtp.speedymx.com). The server responds with a list of supported features, including 8BITMIME, SMTPUTF8, STARTTLS, and HELP. Issue: If the server does not respond or responds with an error, the connection might be rejected, or the client may need to use a different identification method like HELO. |
| 2023-04-11 10:49:15 SMTP INBOUND: “250-smtp.speedymx.com” 2023-04-11 10:49:15 SMTP INBOUND: “250-8BITMIME” 2023-04-11 10:49:15 SMTP INBOUND: “250-SMTPUTF8” 2023-04-11 10:49:15 SMTP INBOUND: “250-STARTTLS” 2023-04-11 10:49:15 SMTP INBOUND: “250-HELP” 2023-04-11 10:49:15 SMTP INBOUND: “250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. – SpeedyMX” | The server responds with a list of supported features, including 8BITMIME, SMTPUTF8, STARTTLS, and HELP. Note: If the server does not respond or responds with an error, the connection might be rejected, or the client may need to use a different identification method like HELO. |
| 2023-04-11 10:49:15 CLIENT -> SERVER: STARTTLS | STARTTLS command: The client sends a STARTTLS command to initiate a secure connection. |
| 2023-04-11 10:49:15 SMTP INBOUND: “220 Ready to start TLS – SpeedyMX”2023-04-11 10:49:15 SERVER -> CLIENT: 220 Ready to start TLS – SpeedyMX | The server acknowledges this request and is ready to begin TLS. Note: If the server does not support TLS or there is a problem with the TLS handshake, the secure connection might fail, leading to email transmission issues. |
| 2023-04-11 10:49:15 CLIENT -> SERVER: EHLO lab.nanopo.st | EHLO command again: The client sends another EHLO command after establishing the secure connection to re-negotiate the supported features. |
| 2023-04-11 10:49:15 SMTP INBOUND: “250-smtp.speedymx.com” 2023-04-11 10:49:15 SMTP INBOUND: “250-8BITMIME” 2023-04-11 10:49:15 SMTP INBOUND: “250-SMTPUTF8” 2023-04-11 10:49:15 SMTP INBOUND: “250-AUTH LOGIN PLAIN” 2023-04-11 10:49:15 SMTP INBOUND: “250-HELP” 2023-04-11 10:49:15 SMTP INBOUND: “250 2.0.0 Hi lab.nanopo.st (2a01:7e00::f03c:93ff:fe3b:a774). Nice to meet you, my name is smtp.speedymx.com. – SpeedyMX” | The server responds with a new list of supported features, including AUTH LOGIN and PLAIN. |
| 2023-04-11 10:49:15 Auth method requested: UNSPECIFIED 2023-04-11 10:49:15 Auth methods available on the server: LOGIN,PLAIN 2023-04-11 10:49:15 Requested auth method not available: 2023-04-11 10:49:15 Auth method selected: LOGIN | Client and server agree on the authentication method (LOGIN) |
| 2023-04-11 10:49:15 CLIENT -> SERVER: AUTH LOGIN | Client initiates authentication process |
| 2023-04-11 10:49:15 SMTP INBOUND: “334 VXNlcm5hbWU6” 2023-04-11 10:49:15 SERVER -> CLIENT: 334 VXNlcm5hbWU6 | Server requests username (base64-encoded) |
| 2023-04-11 10:49:15 CLIENT -> SERVER: bGFiQG5hbm9wby5zdA== | Client sends base64-encoded username |
| 2023-04-11 10:49:15 SMTP INBOUND: “334 UGFzc3dvcmQ6” 2023-04-11 10:49:15 SERVER -> CLIENT: 334 UGFzc3dvcmQ6 | Server requests password (base64-encoded) |
| 2023-04-11 10:49:15 CLIENT -> SERVER: dGhpczE1bXlwNHNzdzByZA== | Client sends base64-encoded password |
| 2023-04-11 10:49:16 SMTP INBOUND: “235 2.7.0 Authentication successful – SpeedyMX” 2023-04-11 10:49:16 SERVER -> CLIENT: 235 2.7.0 Authentication successful – SpeedyMX | Server confirms successful authentication Note: If the provided credentials are incorrect or the authentication method is not supported, the server may reject the connection or require a different authentication method. |
| 2023-04-11 10:49:16 CLIENT -> SERVER: MAIL FROM:[email protected] | MAIL FROM command: The client sends the MAIL FROM command, specifying the sender’s email address ([email protected]). |
| 2023-04-11 10:49:16 SMTP INBOUND: “250 OK – SpeedyMX” 2023-04-11 10:49:16 SERVER -> CLIENT: 250 OK – SpeedyMX | Server confirms sender acceptance |
| 2023-04-11 10:49:16 CLIENT -> SERVER: RCPT TO:[email protected] | RCPT TO command: The client specifies the recipient’s email address ([email protected]). |
| 2023-04-11 10:49:16 SMTP INBOUND: “250 2.0.0 Recipient accepted. – SpeedyMX” 2023-04-11 10:49:16 SERVER -> CLIENT: 250 2.0.0 Recipient accepted. – SpeedyMX | Server confirms recipient acceptance. Note: If the recipient’s email address is invalid or the server rejects it, the email cannot be sent. |
| 2023-04-11 10:49:16 CLIENT -> SERVER: DATA | DATA command:: The client sends the DATA command to signal that it is ready to send the email content. |
| 2023-04-11 10:49:16 SMTP INBOUND: “354 End data with <CR><LF>.<CR><LF> – SpeedyMX” 2023-04-11 10:49:16 SERVER -> CLIENT: 354 End data with <CR><LF>.<CR><LF> – SpeedyMX | Server acknowledges and prepares to receive email data |
| 2023-04-11 10:49:16 CLIENT -> SERVER: (email content, including headers, body, and attachments) | Email content transmission: The client sends the email content, including headers and body, line by line. |
| 2023-04-11 10:49:16 CLIENT -> SERVER: . | Client signals the end of the email data with a single period (.) |
| 2023-04-11 10:49:16 SMTP INBOUND: “250 2.0.0 OK: queued as 1234567890ABCDEF – SpeedyMX” 2023-04-11 10:49:16 SERVER -> CLIENT: 250 2.0.0 OK: queued as 1234567890ABCDEF – SpeedyMX | Email queued for delivery: The server responds with a 250 status code, indicating that the email has been successfully queued for delivery.Note: If the message format is incorrect or the server encounters an issue processing the message, it may reject the email or send an error response. |
| 2023-04-11 10:49:16 CLIENT -> SERVER: QUIT | QUIT command: The client sends a QUIT command to terminate the session |
| 2023-04-11 10:49:16 SMTP INBOUND: “221 2.0.0 Bye – SpeedyMX” 2023-04-11 10:49:16 SERVER -> CLIENT: 221 2.0.0 Bye – SpeedyMX | Server acknowledges the QUIT command and ends the SMTP session |
| 2023-04-11 10:49:16 Connection: closed | Connection between client and server is closed |