What Is SMTP? How the Simple Mail Transfer Protocol Works

SMTP, the Simple Mail Transfer Protocol, is the internet standard that sends email from your mail app to your provider’s server and then from server to server until it reaches the recipient’s mailbox. It was written in 1982 for a small network of trusted research hosts. That is why it still accepts whatever sender name it is given.

What Is SMTP? (SMTP Full Form and Meaning)

SMTP stands for Simple Mail Transfer Protocol. It is the set of rules mail servers use to hand messages to each other over TCP (Transmission Control Protocol), defined today in RFC 5321. SMTP only moves outgoing mail. Reading mail in your inbox is a separate job handled by other protocols. So what is SMTP in plain terms? It is the postal sorting system of email, not the mailbox.

Is SMTP a Push Protocol?

Yes. SMTP is a push protocol because the sending side opens the connection and pushes the message to the next server without being asked. Retrieval protocols work the other way: your phone or laptop pulls messages down from the mailbox when you open your mail app.

SMTP vs IMAP vs POP3

An email protocol is a standard way for two systems to exchange mail. Every email uses SMTP at least once; IMAP and POP3 only take over at the end.

Protocol	Job	Direction	Encrypted port (RFC 8314)
SMTP	Sends and relays mail	Push	465 (submission)
IMAP	Syncs a mailbox across devices	Pull	993
POP3	Downloads mail to one device	Pull	995

How Does SMTP Work? A Real SMTP Session, Step by Step

SMTP works as a short text conversation between a client and a server. The client announces itself, names the sender and recipient, sends the message and says goodbye. Each server reply starts with a three-digit code that tells the client whether to continue.

The Four Hops From Outbox to Inbox

Say your office manager, Sam, emails an invoice from sam@example.com to a supplier at example.net (an illustrative example). Four pieces of software handle it:

1. MUA (mail user agent): Sam’s Outlook or Gmail app submits the message to the provider’s MSA (mail submission agent), normally on port 587 or 465, after logging in.
2. MTA (mail transfer agent): The sending server looks up the MX (mail exchanger) record for example.net in DNS (the Domain Name System) to find which server accepts its mail.
3. Relay: The sending MTA connects to the receiving MTA on port 25. The message may pass through more than one relay, such as a filtering gateway.
4. MDA (mail delivery agent): The receiving side files the message into the supplier’s mailbox, where IMAP or POP3 retrieves it later.

What the Conversation Looks Like (Commands and Reply Codes)

Here is a simplified version of the server-to-server step. “S” is the receiving server and “C” is the sending server.

S: 220 mx.example.net ESMTP ready
C: EHLO mail.example.com
S: 250-mx.example.net greets mail.example.com
S: 250 STARTTLS
C: MAIL FROM:<sam@example.com>
S: 250 OK
C: RCPT TO:<accounts@example.net>
S: 250 OK
C: DATA
S: 354 Start mail input; end with <CRLF>.<CRLF>
C: From: "Sam" <sam@example.com>
C: Subject: Invoice 1042
C: (message body)
C: .
S: 250 OK: queued
C: QUIT
S: 221 mx.example.net closing connection

Read the codes like traffic lights. A 2xx reply (220, 250, 221) means success. A 354 means “go ahead and send the body.” A 4xx code, such as 421 or 451, is a temporary failure, so the sender queues the message and tries again later. A 5xx code, such as 550 for an unavailable mailbox or 554 for a failed transaction, is permanent and produces a bounce message. RSET cancels a transaction, and older systems say HELO instead of EHLO.

The detail most explainers miss is that MAIL FROM and RCPT TO form the SMTP envelope, which works like the address on a postal envelope. The “From:” line inside DATA is a separate header that the recipient sees. Nothing in base SMTP requires the two to match. When a bounce goes to an address you did not expect, or a “From” name looks right but the reply-to address is strange, the envelope and header mismatch is usually where to look. The practical takeaway for IT managers: when you troubleshoot delivery or investigate a suspicious message, compare the envelope sender (shown as Return-Path in the headers) with the visible From address before anything else.

What Is SMTP Missing? The 1982 Trusted-Network Design

SMTP is missing sender authentication because it was never designed to need it. Jonathan Postel published the original specification as RFC 821 in August 1982, when the hosts sending mail belonged to universities, labs and government projects that knew each other.

Why SMTP Allows Email Spoofing

The current standard says so plainly. RFC 5321, the Simple Mail Transfer Protocol specification (2008), states that “SMTP mail is inherently insecure” because even “fairly casual users” can talk directly to receiving servers and “create messages that will trick a naive recipient into believing that they came from somewhere else.” It adds that SMTP mail “inherently cannot be authenticated, or integrity checks provided, at the transport level.”

This is the root of display-name fraud, CEO impersonation and fake supplier invoices. In the example session above, the sending server could have typed any address after MAIL FROM, and any name in the From header, and base SMTP would have accepted it. Spam filters and authentication records were added decades later to catch what the protocol lets through.

The practical takeaway is a decision rule. If your domain does not publish authentication records that tell receivers to reject failures, anyone can send mail that claims to be from your exact domain, and many receiving servers will deliver it. Treat that gap as an open door for your customers and suppliers, not just for your own staff.

What Is an SMTP Relay, and When Is It an Open Relay?

An SMTP relay is any server that accepts a message and passes it on to another server, such as a gateway that filters mail or a service that sends invoices for your billing system. An open relay accepts and forwards mail from anyone on the internet, with no login. Spammers hunt for open relays because the mail comes from your IP address and damages your sending reputation. A relay should only accept mail from your own systems or from authenticated users.

1995 to 2018: ESMTP, STARTTLS and SMTP Ports

Later decades added extensions rather than replacing SMTP, which is why one protocol has several names and ports.

SMTP vs ESMTP vs SMTPS

ESMTP (Extended SMTP) is SMTP with optional features. Its framework, RFC 1869 (1995), introduced the EHLO greeting so a server can list what it supports, such as message size limits, STARTTLS or AUTH. Modern servers speak ESMTP.

STARTTLS, defined in RFC 3207 (2002), lets a plain connection upgrade to TLS (Transport Layer Security) encryption. RFC 3207 itself warns that an attacker in the middle can delete the “250 STARTTLS” line so the client never tries to encrypt. SMTP AUTH, standardized in RFC 4954 (2007), adds a username and password check for submission, with replies such as 235 for success and 535 for invalid credentials. SMTPS is the informal name for SMTP wrapped in TLS from the first byte, which is how port 465 works.

What Port Does SMTP Use? (25, 465, 587 and 2525)

SMTP uses port 25 for server-to-server relay and ports 587 or 465 for email clients submitting mail. RFC 8314, “Cleartext Considered Obsolete” (2018), says clients and servers should support both STARTTLS on 587 and implicit TLS on 465, with no significant security difference when both sides require TLS.

Port	Purpose	Encryption	Standard
25	Server-to-server relay (MX delivery)	Optional STARTTLS	RFC 5321
587	Client submission with login	STARTTLS	RFC 6409 (2011)
465	Client submission with login	Implicit TLS	RFC 8314 (2018)
2525	Unofficial fallback some providers offer	Varies	Not assigned to SMTP

The IANA port registry assigns 2525 to an unrelated service, so treat it as a provider workaround, not a standard.

2011 to 2026: How SPF, DKIM, DMARC and MTA-STS Patch SMTP

Because SMTP cannot prove who sent a message, proof was built into DNS instead. SPF (Sender Policy Framework, RFC 7208, 2014) lists the servers allowed to send for your domain. DKIM (DomainKeys Identified Mail, RFC 6376, 2011) adds a cryptographic signature. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when both fail. It was first published as RFC 7489 in 2015, and the IETF replaced it with RFC 9989, a Proposed Standard, in May 2026.

For transport, MTA-STS (MTA Strict Transport Security, RFC 8461, 2018) lets a domain tell sending servers to refuse delivery unless TLS with a trusted certificate succeeds. That closes the STARTTLS stripping gap. Governments pushed adoption: CISA’s Binding Operational Directive 18-01, issued in October 2017, required US federal agencies to enable STARTTLS and move to a DMARC policy of “reject” within one year.

SMTP Security Checklist for SMBs and IT Managers

These steps apply to Microsoft 365, Google Workspace or your own server. In most SMB environments we review, the first three items are where the gaps sit.

• Publish SPF, sign outbound mail with DKIM, and move DMARC from p=none to p=quarantine or p=reject once reports look clean.
• Protect domains that never send email with a “reject everything” SPF and DMARC record.
• Require authentication and TLS on 587 or 465, and turn off any legacy cleartext submission.
• Test that your servers and any scanner, printer or app relays are not open relays.
• Publish an MTA-STS policy so inbound mail to your domain cannot be silently downgraded.
• Inventory every third-party service that sends as your domain, such as CRM, billing and marketing tools.

UK organizations can test their domain with the NCSC’s free email security check, explained in its email security and anti-spoofing guidance for IT managers. US teams should use NIST SP 800-177 Rev. 1, Trustworthy Email (2019), which NIST says applies to federal systems and “will also be useful for small or medium sized organizations.”

SMTP Delivers Mail; Your DNS Records Decide Trust

The short answer to what is SMTP: a 1982 delivery system that moves mail reliably and believes every sender. The protection your business relies on lives in the records and settings layered around it. This week, look up your domain’s SPF, DKIM, DMARC and MTA-STS records and note which ones are missing. If you would like a second pair of eyes, Cyber Security Solutions Ltd offers a free, no-obligation cyber security assessment through the contact page at cybersecuritysolutionsltd.com.