What is SMTP?

Simple Mail Transfer Protocol is an internet standard communication protocol that uses Transmission Control Protocol (TCP) to send and receive email messages and is commonly used by email service providers like Outlook and Gmail. The SMPT protocol typically sends messages to a mail server, which in turn relays the email to the intended recipient.

SMPT uses the communications protocol TCP to send email messages. There are four steps to this. Firstly, the SMPT connection is opened between the email client and the mail server. Secondly, the email data is transferred from the email client to the mail server; this includes the content of the email, its destination, the subject line, and any additional components. Next, the mail server uses Mail Transfer Agent (MTA) to verify the domain of the recipient email address. If it differs from the sender’s, it will query Domain Name System (DNS) to find the recipients IP address. Finally, the email client will let the server know that the email data has been transmitted successfully and the server will close the connection. The first email server is rarely the final destination, and these steps will be repeated until the email finally reaches a mail server controlled by the intended recipient.

The SMTP server is a mail server that sends and receives emails using the SMPT protocol. Email clients will connect directly with the email service provider’s SMPT server in order to begin the process of transmitting an email. It uses a Mail Submission Agent (MSA) to receive the email from the email client before transferring it to the next mail server in the delivery chain using the Mail Transfer Agent (MTA). Finally, the SMPT sever uses a Mail Delivery Agent (MDA) to receive the email from the MTA downloads them onto the recipient’s mailbox.

‍

The SMPT server and SMPT server address can both be found by:

• Logging into the email client or interface and locating settings/preferences.
• Finding the outgoing mail sever/SMPT settings.
• Find the listed server address. This is the SMPT server address.

‍

Originally port 25 was the standard port used for SMPT, however it should now use port 587 which is the port for SMPTS. The main reason for this is that port 25 is not encrypted and therefore poses security risks and port 587, can encrypt the transmission of emails. Other ports that could be seen using SMPT are the port 465 and 2525.

SMPT commands are predefined instructions that let the email client know what to do with email data and how to handle it. There are several SMPT commands that are used in email communications, including DATA, HELO and RSET. DATA helps to define information as the data text of the body of the email, HELO identifies the domain name of the sender), and RSET, resets the SMPT process to the beginning state. There are many other commands which can be found here: (https://www.ibm.com/docs/en/zos/2.2.0?topic=set-smtp-commands).

As SMPT is an unencrypted communication protocol it presents a potential security risk for organizations when sending out emails containing sensitive data. It also does not support authentication algorithms, meaning threat actors are able to easily send malicious emails using spoofed addresses. This leaves organizations susceptible to spam, phishing, data leaks, malware, and Denial-of-Service (DoS) attacks.

While authentication elements like Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) have been implemented to try and secure SMPT, organizations should still use SMTPS where possible to ensure emails can be sent and received securely.