Mail server monitors
A mail server monitor connects to an SMTP, IMAP or POP3 server and checks that it answers like a mail server. It also checks that TLS works in the mode you select. Spectate never logs in and never sends or reads mail, so the monitor needs no credentials.
Add a mail server monitor
- In the sidebar, select Monitors.
- Select Create monitor.
- Under Type, select SMTP, IMAP or POP3.
- In Target, enter the host name, for example
smtp.example.com. Add:PORTto use another port. - Under TLS, select STARTTLS, TLS or None.
- Select Create and start.
If the target has no port, Spectate adds the default port of the TLS mode when it saves the monitor.
Default ports and TLS modes
| Type | TLS mode | Default port | Default mode |
|---|---|---|---|
| SMTP | STARTTLS | 587 | Yes |
| SMTP | TLS | 465 | |
| SMTP | None | 587 | |
| IMAP | TLS | 993 | Yes |
| IMAP | STARTTLS | 143 | |
| IMAP | None | 143 | |
| POP3 | TLS | 995 | Yes |
| POP3 | STARTTLS | 110 | |
| POP3 | None | 110 |
In the mode TLS, the connection uses TLS from the first byte. This is also called implicit TLS. In the mode STARTTLS, the checker connects without encryption and then upgrades the session. It sends STARTTLS to SMTP and IMAP servers, and STLS to POP3 servers. In STARTTLS mode the upgrade is required. If the server does not offer it or refuses it, the check fails.
To monitor SMTP on port 25, enter the port in the target, for example mx.example.com:25. Spectate does not use port 25 by default.
What a check does
| Type | Steps | Up when |
|---|---|---|
| SMTP | Read the greeting, send EHLO. With STARTTLS: send STARTTLS, upgrade, send EHLO again. Then QUIT. | The greeting is 220, EHLO gets 250, and the upgrade works if required |
| IMAP | Read the greeting. With STARTTLS: send STARTTLS and upgrade. Then LOGOUT. | The greeting starts with * OK or * PREAUTH, and the upgrade works if required |
| POP3 | Read the greeting. With STARTTLS: send STLS and upgrade. Then QUIT. | The greeting starts with +OK, and the upgrade works if required |
The check fails if any of these is true:
- The host name does not resolve, or resolves to a private or reserved address.
- The connection, a reply or the TLS handshake fails.
- The certificate is not valid, and Allow invalid certificates is off.
- The check takes longer than Timeout.
The response time does not include the closing QUIT or LOGOUT. The monitor Overview shows the first line of the greeting as the banner.
Certificates
In TLS and STARTTLS mode, the checker verifies the certificate against its trust store and the host name of the target. It uses TLS 1.2 or newer.
Select Allow invalid certificates to count the check as up when the certificate does not verify. Use it for self-signed certificates or an internal certificate authority. A mail server monitor with TLS can also have certificate checks, which alert before the certificate expires.
Settings
| Setting | Values | Default |
|---|---|---|
| Target | host or host:port | |
| TLS | STARTTLS, TLS or None | SMTP: STARTTLS. IMAP and POP3: TLS. |
| Connection timeout | 1 to 60 seconds, for the TCP connection only | The value of Timeout |
| Allow invalid certificates | On or off. Not with None. | Off |
These settings are in the Connection section of the monitor settings. In the API, the TLS mode is advanced_settings.tls_mode: starttls, tls or none.