Mail Servers
Check that your SMTP server accepts connections and logins, and that your IMAP and POP3 mailboxes can be reached and opened, with the whole session laid out step by step when one fails.
What a mail check does
There are three mail monitors, one per protocol: the SMTP mail monitor, the IMAP mail monitor and the POP3 mail monitor. Each one connects to your mail server on the port you set, reads its greeting, and logs in if you gave it a username and password. A check passes when the whole session completes. It fails when the server can't be reached, the greeting is wrong, the encryption can't be set up, the login is refused, or the server doesn't answer within the monitor's Timeout (30 seconds unless you change it).
Before logging in, each check also asks the server what it supports: EHLO for SMTP, CAPABILITY for IMAP and CAPA for POP3. That is how the monitor page knows the server's login methods, extensions and whether it offers STARTTLS. This first look is for information only. If it fails, the check carries on, and only the session that follows decides up or down.
Certificates aren't verified on mail checks. A self-signed or expired certificate doesn't fail the check. To be told before a mail server's certificate expires, add an SSL certificate monitor for the same hostname with its Port set to the mail port, such as 993 or 465.
The server must be reachable from the internet: a hostname that resolves to a private or internal address is refused.
SMTP
The SMTP check connects and says EHLO. With a username and password, it logs in. That shows the server is up, is accepting connections and accepts your credentials. Without credentials, it only checks that the server greets it and answers EHLO. When it passes, the message on the check reads SMTP Server is reachable and authenticated.
By default it doesn't send a message. Fill in Send a test email to and every check also sends a short email, from the Username to that address, and passes only if the server accepts it. The message then reads SMTP Server verified and test email sent to alerts@example.com. This needs a username and password, and sends one email per check from every region, so point it at a mailbox you don't read by hand.
IMAP
The IMAP check logs in and opens a mailbox: INBOX, or the folder you set in Mailbox. A check passes only if both work, so an IMAP mail monitor needs a Username and Password; without them the login is refused and the monitor goes down. Each check records how many messages the mailbox holds. When it passes, the message reads IMAP Server is reachable and authenticated (INBOX) (Message count: 12).
Set Message count alert to fail the check when the mailbox holds more messages than that, for example a queue or bounce folder that should be emptied. The check then fails with Mailbox Alert: 512 messages in INBOX (exceeds threshold of 500). Leave it empty for no alert.
POP3
The POP3 check connects and waits for the server's +OK greeting. With a username and password, it also logs in with USER and PASS and asks for STAT, which returns how many messages are in the mailbox and how big it is. Then it says QUIT. Without credentials the message on a passing check reads POP3 Server is reachable. With them, it reads POP3 Server is reachable and authenticated (Message count: 12).
Ports and encryption
Encryption decides how the connection is secured. SSL/TLS means implicit TLS, where the connection is encrypted from the first byte. STARTTLS means it starts as plain text and is upgraded before logging in. Pick the one your server expects on that port. Each protocol starts with its usual port and encryption already filled in.
| Monitor | Default | Common ports |
|---|---|---|
| SMTP mail monitor | Port 587, STARTTLS | 587 with STARTTLS; 465 with SSL/TLS; 25 |
| IMAP mail monitor | Port 993, SSL/TLS | 993 with SSL/TLS; 143 with STARTTLS or plain |
| POP3 mail monitor | Port 995, SSL/TLS | 995 with SSL/TLS; 110 with STARTTLS or plain |
How each setting behaves:
| Encryption | What the check does |
|---|---|
| None | Connects and logs in over plain text, even if the server offers STARTTLS. Your password is sent unencrypted. |
| STARTTLS | Connects in plain text, then upgrades the same connection to TLS (STARTTLS for SMTP and IMAP, STLS for POP3) before logging in. If the server doesn't offer the upgrade or refuses it, the check fails before your credentials are sent. |
| SSL/TLS | Uses TLS from the first byte (implicit TLS). |
Authentication
Username and Password are the mailbox account's login. They are usually the full email address and its password, or an app password if your provider requires one. The monitor logs in only when both are filled in:
- SMTP mail monitor: the server picks the login method from the ones it advertises. If either field is empty, no login is tried and the check only tests the connection.
- IMAP mail monitor: logs in with
LOGIN. Credentials are required. - POP3 mail monitor: logs in with
USERandPASS. If both are empty, the check only tests the connection. Don't fill in a username without a password: the check will try to read the mailbox without logging in, and fail.
Create a mail monitor
- 1Choose the type
On the Monitors page, click New, open the type picker and choose SMTP mail monitor, IMAP mail monitor or POP3 mail monitor. They are listed under Infrastructure & services.
- 2Enter the server
Fill in Mail server hostname with the hostname or IP address of the server, such as
mail.example.comorsmtp.example.com. - 3Set the connection
Under Connection settings, set Port and Encryption (None, STARTTLS or SSL/TLS). If you leave Port empty, the protocol's default is used. Then enter Username and Password, and pick a Timeout: how long the check waits for the server at each step (30 seconds by default). For IMAP you can also set the Mailbox and a Message count alert; for SMTP, an address to Send a test email to.
- 4Create it
Pick who is alerted under How should we escalate incidents?, set Check frequency under Advanced settings if 3 minutes doesn't suit you, and click Create monitor.
The settings shared by every monitor (regions, frequency, confirmation and recovery periods, escalation) are described in Monitors.
When it goes down
The message on a failed check starts with the protocol, SMTP Error:, IMAP Error: or POP3 Error:, followed by the reason. The reason is the mail library's error or the server's own reply. Some you may see:
| What happened | Message on the check |
|---|---|
| SMTP login refused | SMTP Error: Invalid login: 535 5.7.8 Authentication credentials invalid |
| SMTP server wouldn't upgrade with STARTTLS | SMTP Error: Error upgrading connection with STARTTLS: 454 TLS not available |
| SMTP connection not made in time | SMTP Error: Connection timeout |
| SMTP server never sent its greeting | SMTP Error: Greeting never received |
| IMAP connection not made in time | IMAP Error: Timed out while connecting to server |
| IMAP login not answered in time | IMAP Error: Timed out while authenticating with server |
| IMAP login refused, or the mailbox can't be opened | IMAP Error: followed by the server's reply |
| IMAP or POP3 server doesn't offer STARTTLS | IMAP Error: STARTTLS is not offered by this server, or for POP3 POP3 Error: STARTTLS refused by server: and the server's reply |
| IMAP mailbox above the message count alert | Mailbox Alert: 512 messages in INBOX (exceeds threshold of 500) |
| POP3 login refused | POP3 Error: followed by the server's -ERR reply |
| POP3 server didn't answer in time | POP3 Error: Timed out waiting for the server |
| The connection failed | The protocol prefix and the connection error, for example a name that doesn't resolve or a refused connection |
| The server resolves to an internal address | A message naming the host and the address it resolves to, ending and cannot be checked from Zharp's servers |
Expand a failed row under Recent checks to see the step that failed and the server's reply. The incident words the cause in plain language and closes on the next check that passes.
The monitor page
All three mail monitors share one layout:
- A bar across the top with the protocol,
host:port, the encryption, and the login method orNO AUTHwhen no username is set. - A response time chart: Delivery time for SMTP, Connection time for IMAP and Retrieval time for POP3. It covers the whole session.
- For SMTP, a DELIVERY TIME card with Encryption, Auth (the login methods the server advertises), TLS, the number of Extensions and Last probe.
- For IMAP and POP3, a MAILBOX card with the message count, Capabilities, TLS and Last check, plus Mailbox and IDLE for IMAP, or Total size for POP3.
- The session transcript (SMTP transcript, IMAP session or POP3 session): each command sent, the server's reply and how long it took, with the failed step in red. It shows the last check, whether it passed or failed.
- Recent checks, one row per check, with the step that failed (or Full delivery / Full session), the Server response, the time and the region it ran from.
- A side card with the Host, Port, Encryption, Auth and Timeout, plus From and Test send for SMTP, or Mailbox and Count alert for IMAP.
Troubleshooting
The check times out or the connection is refused
- Make sure Mail server hostname is the server your mail client uses, and that the port is open to the internet. A firewall that only admits known addresses will block the check.
- Check that Encryption matches the port. SSL/TLS on a plain-text port, or plain text on a TLS port, stalls until the timeout.
The login fails but the password is right
- Many providers turn off password logins for IMAP, POP3 or SMTP, or require an app password. Turn the protocol on for the account, or create an app password and use that.
- Some servers refuse logins on an unencrypted connection. Use SSL/TLS or STARTTLS.
The monitor is down with STARTTLS
The server didn't offer the upgrade on that port. Check that the port is the plain-text one (587, 143 or 110) and not the implicit TLS one (465, 993 or 995), which needs SSL/TLS instead.