Skip to content
Knowledge Hub/Article
Article

What Is SMTP? How Email Travels and the Difference Between Ports 25, 465 and 587

SMTP is the protocol that sends email and carries it between servers. How it works, ports 25, 465 and 587, IMAP and POP3, and SPF, DKIM and DMARC.

Oğuzhan Gerçek··5 min read
What Is SMTP? How Email Travels and the Difference Between Ports 25, 465 and 587

Short answer: SMTP (Simple Mail Transfer Protocol) is the protocol used to send email and to carry it between mail servers; reading is the job of IMAP or POP3. Your email client hands the message to your own server with SMTP (usually port 587 or 465, with TLS), your server finds the recipient's server through the MX record in DNS and delivers the message to it on port 25. Today SMTP's real problem is not transport but trust: SPF, DKIM and DMARC records prove that the sender really is that domain; without them, corporate mail lands in the spam folder or your name is used in forged messages.

What is SMTP?

SMTP is an application-layer protocol in use since 1982, defined in its current form in RFC 5321. It works as a simple text dialogue: the sending server connects (EHLO), announces the sender (MAIL FROM), announces the recipient (RCPT TO), transfers the message (DATA) and closes. The message's headers, body and attachments travel inside that DATA block; attachments are encoded with MIME. The receiving server answers every step with a three-digit code: 250 accepted, 4xx temporary failure (try again later), 5xx permanent rejection.

How does email travel?

  1. Submission: The client (Outlook, a phone, webmail) hands the message to its own organization's submission server; authentication happens here.
  2. Finding the receiving server: The sending server looks up the recipient domain's MX record in DNS; the MX record says which server accepts mail for that domain.
  3. Transfer between servers (relay): The sending server connects to the receiving server on port 25 and transfers the message; there can be several servers along the way, and each adds a Received line to the header.
  4. Delivery: The receiving server writes the message to the mailbox; the user reads it with IMAP or POP3.

Ports 25, 465 and 587

  • 25: The transfer port between servers. Many internet providers block outbound 25 from client devices as an anti-spam measure.
  • 587: The submission port from client to server; the connection starts in cleartext, is encrypted with the STARTTLS command, and authentication is required (RFC 6409).
  • 465: The implicit TLS port for submission; the connection is encrypted from the start. RFC 8314 (January 2018) asks clients and servers to support both STARTTLS on 587 and implicit TLS on 465 during the transition period, and to abandon cleartext as soon as practicable.

The short rule: 587 or 465 in client settings, both encrypted; 25 only between servers.

SMTP, IMAP and POP3

SMTP sends and carries; IMAP and POP3 read. IMAP keeps messages on the server and shows the same mailbox on every device; POP3 downloads the message to the device and usually deletes it from the server. In corporate use, IMAP or Exchange-like protocols are the standard; details are in the business email article.

SPF, DKIM and DMARC: the missing piece of SMTP

When SMTP was designed it did not verify the sender's identity; any address can be written into MAIL FROM. That is the source of phishing mail with forged sender addresses. Three DNS records close the gap:

  • SPF (RFC 7208): Lists which servers may send mail on behalf of the domain.
  • DKIM (RFC 6376): Signs outgoing messages with the domain's private key; the receiver verifies them with the public key in DNS.
  • DMARC (RFC 7489): Says what to do when SPF and DKIM fail (monitor, quarantine, reject) and asks receivers for reports.

Mail from a domain without all three is treated as spam by the large providers or not accepted at all; with them in place, the domain cannot be used in forged messages. In addition, encrypting transfer between servers (STARTTLS and MTA-STS) and filtering mail flow through an email gateway count as the corporate minimum.

Common SMTP errors

  • 550 5.1.1 User unknown: The recipient address does not exist; a typo or a closed account.
  • 550 5.7.1 Relay denied / Relaying denied: The server will not relay on your behalf; authentication or port 587 is missing.
  • 421 or 451 temporary failure: The receiving server is busy or the sender's reputation is low; the server retries later.
  • 535 Authentication failed: Wrong username and password or app password; accounts with MFA need an app password.
  • SPF or DMARC fail: The mail was sent from outside your servers, or the DNS records are incomplete; marketing and CRM tools must be added to SPF.

On the enterprise side

Mail flow security, directory integration, maintenance of the SPF, DKIM and DMARC records and operation of the email gateway are within the scope of our collaboration and messaging platforms service.

Frequently asked questions

What does SMTP mean? Simple Mail Transfer Protocol: the protocol that defines how email is sent from client to server and between servers. Reading is done with IMAP and POP3.

What is an SMTP server? The mail server that accepts users' messages and forwards them to receiving servers; the "outgoing mail server" in email settings.

Which port does SMTP use? 25 between servers; 587 (STARTTLS) or 465 (implicit TLS) for client submission. Clients do not use 25.

What is the difference between SMTP and IMAP? SMTP sends, IMAP reads. An email account uses both: the outgoing server is SMTP, the incoming server is IMAP.

Is SMTP encrypted? Not the protocol itself; it is encrypted with TLS. On the client side STARTTLS (587) or implicit TLS (465), between servers STARTTLS.

Why does my mail land in spam? Most often because the SPF, DKIM and DMARC records are missing, the sending IP's reputation is poor or the sending pattern looks like bulk mail. Set up the three records first, then read the DMARC reports.

Sources