A standard protocol for electronic mail transmission, SMTP (Simple Mail Transfer Protocol) enables mail servers and message transfer agents to send and receive mail messages. User-level email clients typically use SMTP only for sending messages to a mail server for relaying, and typically submit outgoing email to the mail server on port 465 or 587 per RFC 8314. For retrieving messages, IMAP and POP are widely used, but proprietary servers also often implement proprietary protocols, e.g., Exchange ActiveSync. SMTP's origins began in 1980, building on concepts implemented on the ARPANET since 1971. It has been updated, modified and extended multiple times. The protocol version in common use today has extensible structure with various extensions for authentication, encryption, binary data transfer, and internationalized email addresses.
Function and Default Ports
SMTP is responsible for outgoing mail transfer. The default ports used are:
- 25: The original, non-encrypted port (mostly used for server-to-server relay).
- 465: SMTPS (SMTP over SSL/TLS).
- 587: The modern standard for secure mail submission (using STARTTLS).
How the SMTP Process Works
SMTP works through a series of commands and responses between two servers:
- Handshake: The sender’s client (e.g., Outlook or Gmail) connects to the SMTP server and says HELO or EHLO.
- Sender/Recipient Info: The client provides the sender’s address (MAIL FROM:) and the recipient's address (RCPT TO:).
- Data Transfer: The client sends the DATA command, followed by the actual body of the email, headers, and attachments.
- Handoff: If the recipient is on a different network, the sender's SMTP server looks up the MX (Mail Exchanger) record in the DNS to find the recipient's server and forwards the mail.
- Termination: Once the transfer is confirmed with a 250 OK code, the connection is closed using QUIT.
SMTP vs. IMAP/POP3
| Protocol | Direction | Primary Purpose |
| SMTP | Push (Outgoing) | Sends email from a client to a server or between servers. |
| IMAP | Pull (Incoming) | Syncs mail between the server and multiple devices. |
| POP3 | Pull (Incoming) | Downloads mail from the server to a single device (often deleting it from the server). |
Common SMTP Response Codes
If you have ever received a Bounce Back email, it likely contains one of these SMTP status codes:
- 250: Requested mail action okay, completed (Success).
- 421: Service not available, closing transmission channel (Temporary failure).
- 450: Requested mail action not taken: mailbox unavailable (e.g., busy).
- 550: Requested action not taken: mailbox unavailable (e.g., address doesn't exist).
The Security Problem: Spoofing
Originally, SMTP did not require authentication, which allowed anyone to send mail from any address, leading to the explosion of Spam. To combat this, three modern "safety layers" are now used alongside SMTP:
- SPF (Sender Policy Framework): Lists which IP addresses are allowed to send mail for a domain.
- DKIM (DomainKeys Identified Mail): Adds a digital signature to the email header.
- DMARC: Tells the receiving server what to do if SPF or DKIM fails (e.g., Reject it or Quarantine it).
