What the greeting tells you
A healthy SMTP server answers a new connection with a line beginning 220, followed by its hostname and usually its software. That single line confirms a great deal: DNS resolved, the host is reachable, something is listening, and it is speaking SMTP.
The hostname in the banner is worth reading. It should be a name you recognise as belonging to your mail provider. A banner that does not match the domain you queried is normal when mail is outsourced -- a domain using Microsoft 365 will answer with an outlook.com hostname.
The three ports and what each is for
Port 25 is for server-to-server delivery. It is what other mail servers use to deliver mail to you, and it is the port that matters for receiving.
Port 587 is the submission port, used by mail clients to send outgoing mail with authentication. Port 465 is implicit TLS submission: the connection is encrypted before any SMTP conversation begins, which is why this tool negotiates TLS first on that port.
If you are diagnosing why you cannot receive mail, port 25 is the relevant one. If a mail client cannot send, look at 587 and 465.
Why results are usually inconclusive from here
Nearly every cloud provider blocks outbound port 25 to limit spam, and the platform hosting this tool blocks outbound SMTP more broadly still. All three ports will typically report no answer regardless of whether your server is fine.
The tool says so explicitly rather than reporting a failure it cannot stand behind. To get a real answer, run the same test from an unrestricted network -- `telnet mail.example.com 25` or `openssl s_client -connect mail.example.com:465` from a machine at your office will tell you immediately.
What a genuine failure looks like
Connection refused means something actively rejected the connection: the port is closed or a firewall is refusing it. That is a real problem if you expect to receive mail there.
A timeout is more ambiguous -- a firewall dropping packets silently, or a host that is down, or as here, egress filtering on the machine running the test. Distinguishing them requires testing from a network you know is unrestricted.
Frequently asked questions
Why does every port say no answer?
Because this tool runs on a cloud platform that blocks outbound SMTP. It is a limit of where the test runs from, not evidence about your mail server.
How do I test properly then?
From a machine on an unrestricted network, run `telnet mail.example.com 25`. A line starting 220 means the server is answering normally.
Which MX server should I test?
The one with the lowest preference number is tried first by sending servers, so start there. This tool probes the two highest-priority hosts.
Does connecting like this send an email?
No. It opens a connection, reads the greeting and disconnects. No message is composed or transmitted.