SMTP (Email Protocol) – In-Depth Explanation
What is SMTP?
Definition: SMTP stands for Simple Mail Transfer Protocol. It is the standard protocol used for sending email messages across the Internet.
Purpose: Responsible for transmitting and delivering emails from the sender’s client to the recipient’s mail server.
Example: John sends an email from his Gmail account to a colleague at example.com. SMTP is used to deliver John's email from Gmail’s server to the recipient’s mail server.
SMTP Operation
Client-Server Model
Email clients (Outlook, Thunderbird, Gmail app) act as SMTP clients, connecting to SMTP servers to send emails.
Server-to-Server
SMTP servers forward emails to recipient domain servers using SMTP when sending outside the domain.
Step-by-Step Process
- John writes an email to alice@example.com in his email client.
- His client connects to the SMTP server (e.g., smtp.gmail.com) on port 587.
- The server authenticates John and accepts the email for delivery.
- The SMTP server looks up the recipient’s server (example.com) and forwards the email.
- The recipient’s server stores the email until Alice retrieves it (via POP3 or IMAP).
SMTP Ports
| Port | Description | Typical Use |
|---|---|---|
| 25 | Default SMTP port; server-to-server communication | Legacy use, some clients |
| 587 | SMTP with STARTTLS for client submission | Recommended for clients |
| 465 | SMTP over SSL/TLS (deprecated but still used) | Legacy, some providers |
SMTP Commands and Responses
| Command | Description | Example Usage |
|---|---|---|
| HELO / EHLO | Identify client to server | EHLO john.com |
| MAIL FROM: | Specify sender's email address | MAIL FROM:<john@john.com> |
| RCPT TO: | Specify recipient's email address | RCPT TO:<alice@example.com> |
| DATA | Begin message content | DATA |
| QUIT | Terminate session | QUIT |
Example SMTP Session:
S: 220 smtp.example.com ESMTP Postfix
C: EHLO john.com
S: 250-smtp.example.com Hello john.com
C: MAIL FROM:<john@john.com>
S: 250 2.1.0 Ok
C: RCPT TO:<alice@example.com>
S: 250 2.1.5 Ok
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
C: (message content)
C: .
S: 250 2.0.0 Ok: queued as 12345
C: QUIT
S: 221 2.0.0 Bye
Response Codes:
- 220 – Service ready
- 250 – Action completed successfully
- 354 – Start mail input
- 550 – Requested action not taken (mailbox unavailable)
- 421 – Service not available
SMTP Relay
Definition: SMTP relay is the process where one SMTP server forwards an email to another SMTP server, especially across domains.
Open Relay Issue: An open relay accepts mail from any source and forwards it anywhere, which is a major security risk because it can be abused for spam.
Authentication and Security
- SMTP AUTH: Most SMTP servers require authentication (username/password) to prevent unauthorized mail sending.
- Encryption:
- STARTTLS (Port 587): Upgrades an unencrypted connection to encrypted.
- SSL/TLS (Port 465): Encrypted connection from the start.
- Best Practice: Always use authenticated, encrypted SMTP connections for sending mail.
SMTP and Email Delivery Process
Mail Transfer Agent (MTA): Software such as Postfix, Sendmail, or Microsoft Exchange that implements SMTP to receive and forward emails.
Routing and Forwarding: SMTP manages email delivery from sender’s MTA to recipient’s MTA, often querying DNS MX records for routing.
Example: John sends an email to support@company.com. His MTA (smtp.john.com) contacts the MX record of company.com and relays the message to company.com’s mail server.
Integration with Other Email Protocols
SMTP is used for sending and relaying email.
POP3 and IMAP are used by recipients to retrieve and read their emails.
Difference: SMTP is a push protocol (sending outbound mail), whereas POP3/IMAP are pull protocols (receiving inbound mail).
Common SMTP Server Software
- Postfix (Linux/Unix, open source)
- Sendmail (Linux/Unix, older but still in use)
- Microsoft Exchange (Windows environments)
- Exim, qmail, and others
Troubleshooting SMTP Issues
- Bounces and Delivery Failures: Analyze SMTP error codes such as 550 (mailbox unavailable).
- SMTP Logs: Check logs for authentication failures, relay denials, or rejected messages.
- Connectivity: Ensure SMTP ports are open and no firewall blocks traffic.
Exam Points and Tips
- SMTP uses ports 25, 587, and sometimes 465 (legacy).
- Core SMTP commands: HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT.
- SMTP is for sending/relaying mail only, not for retrieving.
- Use authentication and encryption to secure SMTP.
- Be aware of open relay vulnerabilities and how to prevent them.
Example Scenario
John configures his email client with SMTP settings to send business emails via his company’s mail server, using port 587 with STARTTLS and SMTP AUTH for secure communication.