# Mail server monitors

A mail server monitor connects to an SMTP, IMAP or POP3 server and checks that it answers like a mail server. It also checks that TLS works in the mode you select. Spectate never logs in and never sends or reads mail, so the monitor needs no credentials.

## Add a mail server monitor

1. In the sidebar, select **Monitors**.
2. Select **Create monitor**.
3. Under **Type**, select **SMTP**, **IMAP** or **POP3**.
4. In **Target**, enter the host name, for example `smtp.example.com`. Add `:PORT` to use another port.
5. Under **TLS**, select **STARTTLS**, **TLS** or **None**.
6. Select **Create and start**.

If the target has no port, Spectate adds the default port of the TLS mode when it saves the monitor.

## Default ports and TLS modes

| Type | TLS mode | Default port | Default mode |
|---|---|---|---|
| SMTP | **STARTTLS** | 587 | Yes |
| SMTP | **TLS** | 465 | |
| SMTP | **None** | 587 | |
| IMAP | **TLS** | 993 | Yes |
| IMAP | **STARTTLS** | 143 | |
| IMAP | **None** | 143 | |
| POP3 | **TLS** | 995 | Yes |
| POP3 | **STARTTLS** | 110 | |
| POP3 | **None** | 110 | |

In the mode **TLS**, the connection uses TLS from the first byte. This is also called implicit TLS. In the mode **STARTTLS**, the checker connects without encryption and then upgrades the session. It sends `STARTTLS` to SMTP and IMAP servers, and `STLS` to POP3 servers. In **STARTTLS** mode the upgrade is required. If the server does not offer it or refuses it, the check fails.

To monitor SMTP on port 25, enter the port in the target, for example `mx.example.com:25`. Spectate does not use port 25 by default.

## What a check does

| Type | Steps | Up when |
|---|---|---|
| SMTP | Read the greeting, send `EHLO`. With STARTTLS: send `STARTTLS`, upgrade, send `EHLO` again. Then `QUIT`. | The greeting is `220`, `EHLO` gets `250`, and the upgrade works if required |
| IMAP | Read the greeting. With STARTTLS: send `STARTTLS` and upgrade. Then `LOGOUT`. | The greeting starts with `* OK` or `* PREAUTH`, and the upgrade works if required |
| POP3 | Read the greeting. With STARTTLS: send `STLS` and upgrade. Then `QUIT`. | The greeting starts with `+OK`, and the upgrade works if required |

The check fails if any of these is true:

- The host name does not resolve, or resolves to a private or reserved address.
- The connection, a reply or the TLS handshake fails.
- The certificate is not valid, and **Allow invalid certificates** is off.
- The check takes longer than **Timeout**.

The response time does not include the closing `QUIT` or `LOGOUT`. The monitor **Overview** shows the first line of the greeting as the banner.

## Certificates

In **TLS** and **STARTTLS** mode, the checker verifies the certificate against its trust store and the host name of the target. It uses TLS 1.2 or newer.

Select **Allow invalid certificates** to count the check as up when the certificate does not verify. Use it for self-signed certificates or an internal certificate authority. A mail server monitor with TLS can also have [certificate checks](/monitors/certificates), which alert before the certificate expires.

## Settings

| Setting | Values | Default |
|---|---|---|
| **Target** | `host` or `host:port` | |
| **TLS** | **STARTTLS**, **TLS** or **None** | SMTP: **STARTTLS**. IMAP and POP3: **TLS**. |
| **Connection timeout** | 1 to 60 seconds, for the TCP connection only | The value of **Timeout** |
| **Allow invalid certificates** | On or off. Not with **None**. | Off |

These settings are in the **Connection** section of the monitor settings. In the API, the TLS mode is `advanced_settings.tls_mode`: `starttls`, `tls` or `none`.