Sending Email without a Client


Sending e-mail is typically done from an e-mail client such as Microsoft Outlook. There may be times when you wish you could send an e-mail message without needing a client application and thankfully there are a number of ways to accomplish this task. Troubleshooting SMTP can be done via telnet, you can send e-mail from a VBS script or using ASP code, and then there are tools like MAPISend and Blat that allow you to send email from the command line or a batch file.

Pickup Directory

The easiest way to send an e-mail message without a client is to drop a properly formatted text file into the Pickup directory on the server. RFC 822 defines the formatting standards for ARPA Internet text messages. Following the guidelines in RFC 822 you can easily create text files, that when copied into the Pickup directory, will be delivered to the specified mailbox.

When you install the SMTP service on a Windows 2000 or 2003 server a directory called Pickup is created under C:\Inetpub\Mailroot. Let’s look at an example.

Date: 27 Nov 2005 0852 GMT
To: “Fred Flintstone” [email protected]
From: “Barney Rubble” [email protected]
Subject: Interested in Bowling Tonight

Hi Fred,

Are you interested in bowling tonight?


Saving that text to a file and copying it to the Pickup folder would send that e-mail message to Fred. The name of the file is irrelevant because as soon as it is sent the file is deleted. You can even add HTML code to the e-mail. Using HTML will require you to specify the MIME version, content type and encoding. For example:

Date: 27 Nov 2005 0852 GMT
To: “Fred Flintstone” [email protected]
From: “Barney Rubble” [email protected]
Subject: Interested in Bowling Tonight
MIME-Version: 1.0
Content-Type: text/html; charset=”iso-8859-1”
Content-Transfer-Encoding: quoted-printable

Hi Fred,

<b>Are you interested in bowling tonight? </b>


Now if you entered everything correctly, the user will receive the e-mail message. If they do not, look for it in the Badmail folder. If you find it in there, chances are it is not formatted properly. As you can see this method could be easily scripted.

MAPISend and Blat

MAPISend.exe is a command line tool that is available from the Exchange Server 2000 Resource Kit. You can use MAPISend to connect to a mailbox on your Exchange server and send an email message. There are a few basic switches you need to know in order to make it work.

  • -u is used to specify the profile
  • -r specifies the recipients e-mail address
  • -s specifies the subject of the e-mail message
  • -m specifies the body of the e-mail message

In order for MAPISend to work, a MAPI profile must exist on the computer that the e-mail message is being sent from. Let’s look at an example of the MAPISend command.

C:\> MAPISend –u “Exchange Profile” –r [email protected] –s “Interested in Bowling Tonight?” –m “Hi Fred Are you interested in bowling tonight? Barney”

Pretty simple isn’t it? This command can be very useful if you wish to send a message once a batch job has completed running. The message can be sent anywhere. I use this command to send me an e-mail to the SMS address of my Smartphone when certain automated tasks are complete.

If you do not have a copy of the Exchange Server 2000 Resource Kit there is another option called Blat. Blat is a free, command line, SMTP mailer application. It is very similar to MAPISend; however it does not require a mail profile to be present on the sending computer. The important command line switches you need to know are:

  • -t specifies the sender’s e-mail address
  • -r specifies the recipient’s e-mail address
  • -subject specifies the subject

The only big difference between MAPISend and Blat is the body of a message sent with Blat is pulled from a TXT file.

C:\> Blat.exe body.txt –t [email protected] –f [email protected] –subject “Interested in Bowling Tonight?”

Blat is also very useful for sending messages from batch files to SMS addresses or just regular e-mail addresses.


Knowing how to send SMTP commands via telnet is useful for testing firewalls and determining if a mail server is an open relay. Open relays are bad, spammers use them to flood inboxes with junk mail and, if you are running an open relay long enough, you could get added to one of many real-time blacklists (RBL). Getting off a RBL can be a very difficult task.

To send an e-mail message via telnet requires a few things, you need to know the IP address or fully qualified domain name of the server, the SMTP port it is running on (usually TCP 25) and some SMTP commands. Let’s look at an example. Start by opening a telnet session to your Exchange server.

C:\> telnet 25

Figure 1 shows a typical set of SMTP commands used to send an email from one user to another. The yellow dots are only there for your reference as these are the commands that you must enter.

Figure 1: Telnet Example

The first command you have to send is EHLO, which will trigger a number 250 response codes with information on the capabilities of the Exchange or SMTP server. Next, the MAIL FROM specifies whom the mail is being sent from. The RCPT TO will specify the recipient of the message. This is followed by the DATA command. Enter the body of the e-mail message after the DATA command. Once you are ready to send the message press the Enter key, followed by a period, then another Enter. Finally enter Quit to end the telnet session.

Sending e-mail via telnet is an excellent way of testing for an open relay. The above example demonstrated an e-mail message being sent within the domain. If the server were operating as an open relay you would be able to send email to any other domain. By default Exchange server does not allow this to happen and you would get an error message after entering the RCPT TO line. If you are able to send to an outside domain, it is a good idea to check your configuration and ensure that the server is not operating as an open relay.


There are a number of ways to send e-mail messages from a VBS script, too many to cover in one article. Sending e-mail via a VBS script is a handy way to add e-mail notifications to any VBS script you may be using. If you have Outlook installed on the client machine, e-mail can be sent via MAPI. On the other hand, if you have the SMTP service component of IIS installed you can use it and the CDONTS.NewMail object to send a message. Collaboration Data Objects for Windows NT Server (CDONTS) is a component that has been included with all versions if IIS, with the exception of IIS 5.1 in Windows XP.

Using CDONTS and some ASP code it is easy to send e-mail from a webpage. The following is an example of using ASP, the SMTP service and CDONTS to send e-mail.

'Dim variable for the CDONTS NewMail Object
Dim objCDONTSMail 
'Create the e-mail server object
Set objCDONTSMail = Server.CreateObject("CDONTS.NewMail")
'Specify who the message is from
objCDONTSMail.From = "[email protected]"
'Specify who the message is being sent to
objCDONTSMail.To = "[email protected]"
'Specify the subject of the message
objCDONTSMail.Subject = "Interested in Bowling Tonight?"
'Specify the message format (0=HTML 1=Text)
objCDONTSMail.BodyFormat = 0
'Specify the message format (0=MIME 1=Text)
objCDONTSMail.MailFormat = 0
'Specify the Message body contents
objCDONTSMail.Body = "<h2>Hi Fred</h2><br><b>Are you interested in going bowling tonight?</b><br><br>Barney"
'Send the message
'Close the server object
Set objCDONTSMail = Nothing


Sending e-mail messages is something we all do on a daily basis, so often that it comes as second nature. Using some of these alternative methods will allow you to automate the process and implement the ability to send e-mail to scripts.

Telnet –

Blat –

RFC 822 –

Note: The section on CDONTS mentions that it is not available in Windows XP however you can use CDOSYS. You can also use CDOSYS on your Windows 2000/2003 servers if you wish.

About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top