An SMTP connection timeout is one of the most frustrating errors to meet because the message is often vague and the cause can be anywhere between your application and the server. The good news is that nearly every case falls into a small number of groups: the connection never reaches the server, it reaches the server but the TLS handshake fails, or it gets through TLS but authentication is refused. This guide shows how to work out which group you are in, with simple tests, and how to fix each one.
Step 1: Read the error carefully
The wording of the error is the best clue. Different failures look different even when the application shows only a short message.
| What you see | Likely meaning | Go to |
|---|---|---|
| Timed out, no response | Traffic is being dropped before it reaches the server | Step 3: ports and firewalls |
| Connection refused | Nothing is listening, or a rule rejected the attempt | Step 3 |
| Could not resolve host | DNS problem or a typo in the host name | Step 2 |
| SSL or TLS handshake failed, wrong version number | The security mode does not match the port, or a protocol mismatch | Step 4 |
| Certificate verify failed, hostname mismatch | The client does not trust or accept the server certificate | Step 4 |
| 535 authentication failed | The server rejected the username or password | Step 5 |
| 530 authentication required | You did not authenticate, or did not upgrade to TLS first | Steps 4 and 5 |
| Other 4xx or 5xx after login | The connection works; the message was refused or delayed | See the bounce guide |
If the error is a reply to the message itself, for example 550 or 554 after the connection succeeded, the connection is fine and the issue is the content or sender. See SMTP bounce codes explained.
Step 2: Check the host, port and security mode
Most connection failures are a mismatch between the three settings that must agree. Take them from your provider documentation and from the SMTP details shown in your account, and enter them exactly. Our guide to SMTP settings, ports and TLS lists the options.
| Port | Security mode | How it works | Common mistake |
|---|---|---|---|
| 587 | STARTTLS | Plain connection that upgrades to TLS after the EHLO command | Choosing "SSL" in a client that expects STARTTLS here |
| 465 | Implicit TLS (SMTPS) | TLS starts at once, before any SMTP command | Choosing "STARTTLS" or "none" |
| 25 | Server-to-server, often with opportunistic TLS | Used between mail servers | Using it from an application when the network blocks it |
- Check for a typo or trailing space in the host name.
- Make sure the host is the sending host from your provider, not your website host name.
- If your client has only a single "use SSL/TLS" box, check what it does at each port.
- If your platform offers an alternative submission port, it will be listed in the documentation.
Step 3: Test the port from the sending machine
The sending machine is the one that runs the application. A test from your laptop proves little if the server sits on a different network. Log in to the server, or run the test inside the same container, and try to open a connection to the host and port.
# Check that the port is reachable (replace the host with your SMTP host)
nc -vz smtp.example.com 587
# Or with curl, which prints the server greeting
curl -v telnet://smtp.example.com:587The host name in the example is a placeholder. Use the one from your account.
- Connected and greeting shown. The network path is fine. Continue to TLS and credentials.
- Times out. Something is dropping packets. Check the server firewall, the cloud security group, the hosting provider outbound rules and any corporate proxy.
- Refused. Check the port number and the host. A refusal can also come from a local rule that rejects outbound connections.
- Works on one port but not another. The blocked port is the problem. Use the one that works, if your provider supports it.
Port 25 is often blocked on purpose. Many hosting providers and internet providers block outbound port 25 from customer machines to limit spam. This is not a fault with your sending platform. Use the authenticated submission ports in your documentation.
Step 4: Test TLS
If you can connect but the handshake fails, test TLS directly. The OpenSSL command-line tool can open a session and show the certificate and protocol.
# STARTTLS on port 587
openssl s_client -starttls smtp -connect smtp.example.com:587 -servername smtp.example.com
# Implicit TLS on port 465
openssl s_client -connect smtp.example.com:465 -servername smtp.example.comLook at the end of the output for the verification result, the certificate chain and the negotiated protocol. Then match what you see to the usual causes.
| Problem | Cause | Fix |
|---|---|---|
| Wrong version number | Plain text sent to a TLS port, or TLS sent to a plain port | Match the mode to the port |
| Hostname mismatch | Connecting to an IP address or an alias not on the certificate | Use the exact host name from your provider |
| Unable to get local issuer certificate | The client trust store lacks the issuing authority | Update the operating system or runtime certificates |
| Certificate expired or not yet valid | Wrong system clock, or a real expiry | Fix the clock; if the server certificate has expired, contact your provider |
| Protocol or cipher not supported | Very old software or library | Update the library or runtime to support a modern TLS version |
Do not switch off certificate verification to get past an error. That removes the main benefit of TLS and puts your credentials at risk. RFC 8314 explains why encrypted submission is the expected default.
Step 5: Check authentication
A 535 reply means the connection and TLS worked, and the server rejected the login. This is the easiest to fix, but it can look confusing because the cause may be small.
- Wrong username or password. Copy them again from your account, and look for stray spaces added by a paste.
- Special characters. Some applications mishandle characters such as &, # or quotation marks in a password stored in a configuration file or URL. Quote or encode them as the software requires.
- Credential for a different purpose. An API key and an SMTP login can be different things. Use the one that your documentation gives for SMTP.
- Revoked or rotated credential. If someone rotated a key, older systems stop working. See our guide to API key security and rotation.
- Authenticating before TLS. Servers may refuse login on an unencrypted connection. Make sure the upgrade happens first.
- Wrong account or region. If you have several accounts, check that you are using credentials from the one you intend.
If you repeatedly fail to log in, stop and fix the cause rather than retrying in a loop. Repeated failed logins can trigger protective limits. For general retry behaviour, see our guide to rate limits and retries.
Step 6: Look at the network around the server
If the checks above point to a block, work outwards from the application.
- Local firewall. Check rules on the machine, such as iptables, ufw or the Windows firewall.
- Cloud security groups. Many cloud platforms apply outbound rules to instances. Confirm that the port is allowed.
- Hosting provider policy. Some providers block SMTP ports on new accounts or on shared hosting and lift the block on request.
- Corporate network or proxy. Office networks often block SMTP and permit only web traffic. Ask your network team.
- Container or virtual network. A container may not have the same outbound rules as the host. Test inside it.
When SMTP ports are blocked and cannot be opened, a good alternative is to send by HTTPS through the platform API, which uses port 443. See our comparison of SMTP and API sending.
A worked example: a plugin that stopped sending
A small company runs a website on a virtual server. Their contact-form plugin worked for months, then stopped, and the plugin logged only "SMTP connect failed". The administrator follows the steps. The error is a connection failure, not a login reply, so the issue is not credentials. From the server, a connection test to port 587 times out, while the same test from the administrator laptop works. That points to the server network, not the SMTP host.
Checking the hosting dashboard, they find that outbound SMTP ports were restricted on the plan after a policy change. The provider support page explains how to request that the restriction be lifted, and also suggests using port 443 services instead. The company chooses to move the plugin to the platform API integration, which uses HTTPS, and keeps the SMTP settings documented for the future. After the change, a test message arrives and the header check shows SPF, DKIM and DMARC passing, as described in our guide to reading email headers. This example is illustrative, but the pattern of a connection error on one machine and not another is very common.
Step 7: Confirm that the setup works
- Send a test message to an inbox you control.
- Check that the message arrives, and open the full headers to confirm authentication passes.
- Look at the delivery events in your account to see the message recorded as accepted and delivered.
- Write down the working host, port, security mode and where the credentials are stored.
- If you have not yet verified your domain, do it now with our guide to verifying your sending domain.
Quick reference
| Symptom | First thing to try |
|---|---|
| Timeout | Test the port from the server; try 587 or 465 instead of 25 |
| Refused | Check the host and port; check outbound firewall rules |
| Handshake or version error | Match the TLS mode to the port |
| Certificate error | Use the exact host name; update trust store and clock |
| 535 | Re-enter the SMTP credentials; check for rotation |
| Works elsewhere, not here | Compare networks; test from the sending machine |
Still cannot connect? Send us the exact error, the host, port and the time of the attempt, and we will help you trace it.
Further reading and sources
Frequently asked questions
Why does my SMTP connection time out?
The most common cause is a network or firewall rule that silently drops traffic on the port you are using. Hosting providers and internet providers often block outbound port 25, and sometimes others. Try the submission ports your provider documents, 587 or 465, or an alternative port if one is offered.
What is the difference between ports 587 and 465?
Both are used for authenticated submission. Port 587 starts as a plain connection and upgrades with STARTTLS. Port 465 uses TLS from the first byte, which is called implicit TLS. Choose the mode that matches the port, because mixing them causes handshake errors.
What does error 535 mean?
It is the SMTP reply for authentication failed. The server received your credentials and rejected them. Check the username, password and any key you were given, and make sure you are connecting to the right host and account.
What does connection refused mean?
The server answered and said nothing is listening on that port, or a firewall actively rejected the attempt. Check the host name, the port and whether you can reach the host at all from this network.
Why do I get a certificate error?
The client may not trust the certificate, the hostname you used may not match the name on it, the certificate may have expired, or the system clock may be wrong. Use the exact host name given by your provider and keep your system trust store and clock up to date.
Should I turn off certificate checking to make it work?
No. Disabling verification removes the protection TLS provides and exposes your credentials to interception. Fix the underlying cause, such as the hostname or the trust store, instead.
Can port 25 be used to send from my application?
Port 25 is intended for server-to-server delivery. Many networks block it for customers, and submission with authentication on 587 or 465 is the normal choice for applications. Use what your provider documents.
Why does it work from my laptop but not my server?
Different networks have different rules. Your server host or data centre may block outbound SMTP ports that your office or home network allows. Test from the server itself, not from another machine.
Could an old TLS version cause failures?
Yes. Servers commonly require a modern TLS version, and very old software or libraries may not support it. Update the library or runtime, and see your provider documentation for the minimum supported version.