Sending
Alice writes to bob@example.com in her mail app. Her app builds the message: header lines such as From:, To: and Subject:, a blank line, then the text. The part after @, example.com, says where it must go.
Her app connects to her provider's server, mail.example.org, on port 587. It switches on encryption (STARTTLS), logs in, and hands over the message. This is SMTP submission (RFC 6409).
SMTP carries two sets of addresses. The envelope (MAIL FROM, RCPT TO) tells servers where to deliver, like the outside of a paper envelope. The From: and To: headers are the letter inside, for people. They can differ: Bcc is only on the envelope.
Finding the way
Which machine takes mail for example.com? The server asks its DNS resolver for the domain's MX record (mail exchanger), a DNS record that names the domain's mail servers.
The answer: mx.example.com, preference 10, at 203.0.113.25. A domain can list several MX servers; senders try the lowest preference number first and fall back to the others.
mail.example.org opens SMTP to mx.example.com on port 25, the server-to-server port (RFC 5321). It upgrades to TLS if offered, repeats the envelope, then sends the whole message after DATA.
Checking the sender
Anyone can type any From: address, so Bob's server checks example.org in DNS. SPF lists the servers allowed to send its mail. DKIM publishes a public key that checks the signature Alice's server added.
DMARC (RFC 7489) asks one more thing: does the domain in the From: line people see match a domain that passed SPF or DKIM? Here both match. A fake that failed would be rejected, as example.org's policy asks.
Delivery and reading
Bob's server replies 250 OK, so it is now responsible for the message, and files it in Bob's mailbox with a Received: line on top. Had delivery failed, a bounce would go to the envelope MAIL FROM.
Later Bob opens his mail app. It connects to his server with IMAP (RFC 9051) on port 993, encrypted with TLS from the first byte, logs in and opens his inbox.
The server sends Alice's message down to Bob's app. With IMAP the original stays on the server, so his phone and laptop see the same mailbox. Older POP3 (port 995) downloads it and usually deletes the server copy.
The messages, step by step
;; step 1/11 · compose ;; at: alice From: Alice <alice@example.org> To: Bob <bob@example.com> Subject: Hello Date: Fri, 23 Oct 2026 09:30:00 +0000 Hi Bob, … (RFC 5322 format: headers, one blank line, then the body)
SPF checks the envelope MAIL FROM domain, DKIM the signing domain, and DMARC ties either one to the visible From: domain. None of them encrypts the mail. STARTTLS between servers is opportunistic: if the receiver does not offer it the mail may still be sent unencrypted. MTA-STS (RFC 8461) and DANE (RFC 7672) let a domain insist on TLS.