SMTP Error 111

Is "SMTP Error 111" a real SMTP code?

No. This is the single most important thing to understand before you troubleshoot. SMTP reply codes are three-digit numbers returned inside an SMTP conversation — 220, 250, 421, 450, 550, and so on, defined in RFC 5321 §4.2. There is no SMTP reply code 111.

The 111 you are seeing is a POSIX/Linux errno — ECONNREFUSED, "Connection refused." It is a TCP socket error reported by the operating system, surfaced by mail libraries such as PHPMailer (SMTP ERROR: Failed to connect to server: Connection refused (111)) and Python's smtplib/socket (ConnectionRefusedError: [Errno 111] Connection refused).

This distinction changes everything: ECONNREFUSED happens at the network layer, before SMTP starts. Your client never got far enough to greet the server, authenticate, or name a recipient. That means causes like a misspelled recipient address, bad SMTP username/password, or a recipient "blocking the port" are not possible explanations — you never reached the SMTP dialogue where those would matter.

What causes SMTP Error 111 (ECONNREFUSED)?

ECONNREFUSED means your TCP SYN reached a host but was actively rejected (typically a TCP RST), or was dropped/blocked on the way out. Concretely:

• Wrong host or port. Connecting to a hostname that isn't running an SMTP listener, or to a port the server isn't listening on. Valid submission ports are 587 (STARTTLS) and 465 (implicit TLS) — both endorsed by RFC 8314; port 25 is for server-to-server relay and is widely blocked for client submission.
• Outbound firewall blocks. Many hosts (and ISPs) block outbound 25/465/587 by default to limit spam. This is a common cause on shared/VPS hosting.
• Host-level SMTP restrictions. cPanel's "SMTP Restrictions" feature (in WHM's Security Center) forces port-25 traffic from non-root users through the local Exim MTA rather than letting scripts reach remote mail servers directly on that port. A similarly named but separate firewall-level block (e.g., CSF's SMTP_BLOCK) can also restrict 465/587 — check both if the connection is refused locally.
• Nothing listening. Pointing at localhost/127.0.0.1 when no local MTA is running.
• IPv6 vs IPv4. The hostname resolves to an AAAA (IPv6) address that's filtered, while IPv4 would work.

How do I fix SMTP Error 111?

1. Confirm the host and port, and test raw connectivity. From the same server that sends mail, test the TCP path:

# Does the port even open? (any non-blank greeting = TCP is fine)
openssl s_client -connect smtp.example.com:465      # implicit TLS
openssl s_client -starttls smtp -connect smtp.example.com:587   # STARTTLS
# or, plain reachability:
nc -vz smtp.example.com 587

If this hangs or returns "Connection refused," the problem is the network path/port, not your mail code.

2. Open outbound firewall rules. Ensure egress is allowed on your provider's submission port (usually 587 or 465). On a server you control, allow outbound; on shared hosting, ask the host to confirm outbound SMTP isn't blocked.

3. Lift host SMTP restrictions. On cPanel/WHM, disable "SMTP Restrictions" (or the equivalent CSF SMTP_BLOCK rule) or add your sending user to the allow list so scripts can reach external relays.

4. Match the port to the encryption mode. Use 465 with implicit TLS, or 587 with STARTTLS — don't mix them (e.g., requesting STARTTLS on 465).

5. Force IPv4 if IPv6 is filtered. In PHPMailer, set the host to the resolved IPv4 address (gethostbyname('smtp.example.com')) to bypass a blocked AAAA record.

6. Get a transcript. In PHPMailer set $mail->SMTPDebug = 2;; in Python enable smtpObj.set_debuglevel(1). This confirms whether you fail at TCP connect (111/ECONNREFUSED) versus later in the handshake.

Note on Gmail / Google Workspace

If your host is smtp.gmail.com and the TCP connection itself succeeds but auth later fails, that's a different problem. Less Secure Apps access was retired for personal Gmail accounts in 2022, and Google Workspace accounts lost password-only third-party access in stages through 2024-2025 — so it's not viable for either account type today. Use an App Password (requires 2-Step Verification) or OAuth2 instead. But if you're getting 111 against Gmail, you're still at the connection-refused stage: it's almost always your outbound firewall blocking 587/465, not credentials.