How Does The Internet Do Email (SMTP)

Let's say Dr. Sue Sender wants to send an email to Gus Getter. Sender uses some program to write her email, say Outlook, Apple Mail, or gmail.com. When she hits "send", the email may bounce around a bit inside her hospital but eventually lands on a computer (a "Server") connected to the Internet.

That Server uses the Internet to hand the email to a Server located in Gus's environment where, similar to the hospital, it may bounce around a bit until get gets someplace Getter can see it.

This document is a simple explanation of exactly how those two Servers transfer an email.

Simple Mail Transport Protocol (SMTP)

One of the very first things that the Internet could do was email (circa 1971), long before shopping, videos, facebook, and google. Still today one of the biggest uses of the Internet is email. The smart people who worked on the early Internet designed a way for email to work that was so good it is still how email works today. It's called "SMTP" which stands for Simple Mail Transport Protocol. And it really is simple yet still powerful enough to transport all email sent through the Internet.

SMTP Example

SMTP is a language that Servers use to send mail over the Internet. Here is a example of an SMTP conversation. Lines are colored to show if they came from Getter or Sender.

SMTP Example Deconstructed

The email transfer starts with Sender's Server contacting Getter's Server and saying "I want to send you an email". How that works is described at the bottom of this post – it's not SMTP.

Getter's Server starts the dialog with a Greeting that has its name:

Sender's Server says Hello and gives its name:

Getter's Server says Hello back and gives Sender some info about itself:

Sender then says it has a message from Sue:

Getter says it will accept an email from Sue (Getter could say it will not accept a message from Sue):

Sender then says the message is for Gus:

Getter says it will accept an email for Gus (Getter could say it will not accept a message for Gus):

Sender then says I'm ready to send the email contents:

Getter answers that it's ready to receive the email contents:

Sender then sends the message headers and message body, separated by a blank line and ending with a single dot on a line by itself:

Getter says it got the message and will deliver it (Getter could say it will not deliver the message):

Sender then says it is finished (it could have had another message to send).

Getter says ok and disconnects:

Keeping Email Safe (STARTTLS)

By the late 1990's Internet email was being used to communicate things that should be kept private: credit card numbers, doctor/patient information, trade secrets. All this information was out on the Internet where anyone with access could see it. So the next generation of smart people working on the Internet designed a way for SMTP to use encryptiony to hide the SMTP. It's called STARTTLS and again it was so good that it is still in use today, even with state-of-the-art quantum encryption.

STARTTLS Example

Here is an example of STARTTLS in an SMTP conversation:

Uncolored lines starting with ~~~ are not real: they are the decrypted contents of the binary data that was actually sent. Only Gus and Sue's servers know the decrypted contents, the Internet can only see the unintelligable binary data.

Keeping Email Even Safer

Since STARTTLS there have been a number of additional security features grafted onto Internet email. These are beyond the scope of this document, but they include:

SPF

adds security to HELO and MAIL FROM parts of SMTP
i.e. mail.sender-server is allowed to send mail that says it is from sender-company.com

DKIM

adds security to MAIL FROM and DATA parts of SMTP
i.e. it signs and protects the email like a wax-seal on a paper envelope

DMARC

adds even more security to SPF and DKIM

MTA-STS

adds security help Sender be sure they are connecting to Getter's real servers

DANE

adds security features to SSL Certificate usage

TLS-RPT

provides a way for Sender to tell Getter something is wrong with Getter's email

BIMI

provides visual confirmation to Gus that the email really came from Sue

DNSSEC

adds security to all DNS name lookups
i.e. prevents someone from saying my IP address is also good for mail.sender-company.com

FCrDNS

makes sure host names and addresses match
i.e. prevents someone from saying this host name goes to this (bad) IP address

Before SMTP Starts

We said above that before SMTP, an email transfer starts with Sender's Server contacting Getter's Server and saying "I want to send you an email". Sender knows it wants to send an email, but how does Getter know that Sender is out there wanting to send it something?

Getter's Server is like an amusement park. Just as an amusement park has different locations for the different ride lines, Servers have different locations ("Ports") for the different things they can do. Each different Port knows how to talk a certain Protocol (language), like the SMTP language described above. These protocols are things like "send me this webpage" (HTTP), "tell me what the IP address is for this domain name" (DNS), "let me run a program" (TELNET, SSH, RDP), or "I want to send you an email" (SMTP).

So when a Sender wants to send an email, it contacts a Getter's Server on the SMTP Port (port #25), and the two of them know to start talking SMTP.