How email is delivered
Follow one email from Alice's laptop to Bob's. Her app hands it to her own mail server on port 587, that server asks DNS where example.com takes its mail (the MX record) and relays it over SMTP on port 25, Bob's server checks the sender with SPF, DKIM and DMARC, and Bob reads it with IMAP.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01How does Alice's mail server find out which machine accepts mail for example.com?
The MX (mail exchanger) record names the domain's mail servers and a preference number; the lowest preference is tried first.
02Which port does a mail app use to hand a new message to its own provider?
Port 587 is SMTP submission (RFC 6409), with a login. Port 25 is for server-to-server relay, 993 is IMAP and 53 is DNS.
03What is the difference between the envelope and the headers?
SMTP carries the envelope as commands, separate from the message. A Bcc recipient, for example, appears only in the envelope.
04What does DMARC add on top of SPF and DKIM?
SPF and DKIM can pass for some other domain. DMARC ties the result to the From: domain people actually see, and says none, quarantine or reject.
05Why can Bob see the same mailbox on his phone and his laptop?
IMAP (RFC 9051) keeps mail on the server. POP3 usually downloads messages and deletes the server copy, so other devices would not see them.
Glossary
- SMTP
- Simple Mail Transfer Protocol: how mail is handed from an app to a server and from server to server.
- Submission
- SMTP on port 587, with a login, used by a mail app to give new mail to its own provider.
- MX record
- A DNS record that names a domain's mail servers, each with a preference number (lower is tried first).
- Envelope
- The SMTP addresses MAIL FROM and RCPT TO that servers use for delivery, separate from the message's headers.
- Headers
- Lines at the top of the message such as From:, To:, Subject: and Date:, shown to people.
- SPF
- A DNS TXT record listing which servers may send mail for a domain.
- DKIM
- A signature a sending server adds to a message, checked with a public key the domain publishes in DNS.
- IMAP
- The protocol a mail app uses to read mail that stays on the server (port 993 with TLS).
Notes and sources
- Domains are RFC 2606 examples; 198.51.100.25, 198.51.100.53 and 203.0.113.25 are RFC 5737 documentation addresses and 192.168.1.10, 192.168.50.20 are private RFC 1918 addresses. Client ports, the date, the DKIM selector and the message size are illustrative.
- Submission can also use port 465 with TLS from the first byte (RFC 8314). Port 25 is only for server-to-server relay; many home networks block it outgoing.
- Here one machine, mx.example.com, both receives mail and serves IMAP; big providers usually split these roles across many servers.
- STARTTLS between servers is opportunistic: if the receiver does not offer it the mail may still be sent unencrypted. MTA-STS (RFC 8461) and DANE (RFC 7672) let a domain insist on TLS.
- SPF checks the envelope MAIL FROM domain, DKIM the signing domain, and DMARC ties either one to the visible From: domain. None of them encrypts the mail.
- Real mail often passes through more servers (filters, forwarders, mailing lists); each adds its own Received: line.
Quiz Unlocks after the last step.