Start an SMTP session

An SMTP conversation starts with the server talking. It sends a 220 greeting as soon as you connect. Then the client introduces itself with EHLO and its own hostname.

The server answers with 250. If the reply has several lines, each extra line advertises an extension, an optional feature like SIZE, STARTTLS, AUTH, or 8BITMIME.

S: 220 smtp.fastmail.com ESMTP ready
C: EHLO laptop.local
S: 250-smtp.fastmail.com
S: 250-SIZE 52428800
S: 250 STARTTLS

Read this as a menu. The server just told us it accepts messages up to 50 MB and can upgrade to TLS. Anything it didn’t list, we must not use.

Talk to a real server

You can have this conversation by hand. Open a TLS connection to a submission server and type EHLO:

openssl s_client -starttls smtp -crlf -connect smtp.fastmail.com:587

After the handshake output, type EHLO laptop.local and press Enter. You’ll get a list of 250- lines. Type QUIT when you’re done.

How multiline replies work

A multiline reply uses a hyphen after the code on every line except the last. The last line uses a space:

S: 250-smtp.fastmail.com
S: 250-PIPELINING
S: 250-SIZE 52428800
S: 250 STARTTLS

That final space is how a client knows the reply is complete. Be careful here. A client that stops reading after the first line misses the size limit. Worse, it might try AUTH before the server said it supports it, and get a confusing error.

When EHLO fails

A very old server can reject EHLO. The client can fall back to HELO, the original command. But HELO gets no extension list, so the client is flying blind.

My advice for anything you write: if the message needs an extension, like SMTPUTF8 for a non-ASCII address, and the server didn’t advertise it, fail loudly. Don’t guess and hope.

Say EHLO twice

After STARTTLS succeeds, the client sends EHLO again. The capabilities from before encryption are thrown away.

This isn’t ceremony. The server often advertises AUTH only inside the encrypted session, because it refuses to accept passwords in cleartext. If you skip the second EHLO, you never see the authentication mechanisms.

Try annotating the first transcript above: mark the server identity, every extension, the final line, and the command you’d repeat after the TLS upgrade.