Email Messaging Protocols

Email messaging protocols enable the sending and receiving of electronic messages across networks. Three core protocols handle different aspects of email communication: SMTP sends and relays messages between servers, while POP and IMAP retrieve messages from servers to clients. Understanding how these protocols work together is essential for cybersecurity professionals managing email infrastructure.

Key Points

• SMTP (Simple Mail Transfer Protocol) sends and relays emails between clients and servers
• POP (Post Office Protocol) downloads emails from server to local device
• IMAP (Internet Message Access Protocol) accesses and synchronizes emails across multiple devices
• All three protocols operate at OSI Layer 7 (Application Layer) using TCP transport
• Email clients use different protocols for sending versus receiving messages
• Webmail services use HTTP/HTTPS instead of traditional email protocols

Protocol Overview

Protocol	Primary Function	Default Port	Direction	Use Case
SMTP	Send/relay emails	TCP 25	Client → Server, Server → Server	Outgoing mail
POP	Download emails	TCP 110	Server → Client	Single device access
IMAP	Access/sync emails	TCP 143	Server ↔ Client	Multiple device access

How Email Sending Works (SMTP)

SMTP is responsible for transmitting emails from sender to recipient mail servers. The protocol handles two critical functions:

• Client-to-server: When users send emails from their email client
• Server-to-server: When mail servers relay messages to destination servers

SMTP Message Flow

1. User composes email in client (Outlook, Thunderbird)
   ↓
2. Client sends via SMTP (TCP 25)
   ↓
3. Sender's mail server receives message
   ↓
4. Server relays to recipient's mail server (SMTP)
   ↓
5. Recipient's server stores email

Email Message Structure

Component	Contents
Header	Sender address, recipient address, subject, metadata
Body	Actual message content

Important: SMTP only sends and relays emails—it cannot retrieve or read messages from a server.

How Email Receiving Works (POP vs IMAP)

Once an email reaches the recipient's mail server, it must be retrieved using either POP or IMAP. These protocols serve different use cases.

POP (Post Office Protocol)

POP downloads emails from the server to a local device, typically removing them from the server afterward.

Characteristics:

• Simple download-and-store model
• Emails stored locally on one device
• Limited synchronization capabilities
• Best for single-device users
• Uses TCP port 110

Typical behavior:

1. Client connects to mail server
2. Downloads all new messages
3. Optionally deletes messages from server
4. Disconnects

Limitation: POP is not ideal for users accessing email from multiple devices, as messages exist only on the device that downloaded them.

IMAP (Internet Message Access Protocol)

IMAP allows clients to access and manage emails directly on the server, maintaining synchronization across all devices.

Characteristics:

• Emails remain on server
• Full folder structure synchronization
• Message state tracking (read/unread/flagged)
• Ideal for multiple devices
• Uses TCP port 143

Key advantages:

• Access same mailbox from phone, laptop, and tablet
• Changes sync across all devices
• Server-side search and organization
• No local storage required

Modern standard: IMAP is the preferred protocol for contemporary email usage patterns involving multiple devices.

Email Clients vs Webmail

Understanding the distinction between traditional email clients and webmail is crucial for security analysis.

Email Clients (Mail User Agents)

Desktop or mobile applications installed locally:

• Examples: Microsoft Outlook, Mozilla Thunderbird, Apple Mail
• Sending: Use SMTP to send messages
• Receiving: Use POP or IMAP to retrieve messages
• Protocols: SMTP, POP/IMAP over TCP

Webmail Services

Browser-based email access:

• Examples: Gmail, Outlook.com, Yahoo Mail (accessed via browser)
• Protocol: Use HTTP/HTTPS for all operations
• No client software: Access through web interface
• Different architecture: Does not use traditional POP/IMAP protocols

Practical Example: Corporate Email Flow

Scenario: Employee sends email to external client

1. Employee composes message in Outlook (email client)
2. Outlook connects to company mail server using SMTP (port 25)
3. Company mail server validates and accepts message
4. Company server relays message to client's mail server via SMTP
5. Client's mail server stores message in recipient's mailbox
6. Recipient opens their email client
7. Client retrieves message using IMAP (port 143)
8. Message appears synchronized across recipient's devices

Security Considerations

Port Usage

Protocol	Standard Port	Secure Alternative	Encryption
SMTP	25	587 (submission), 465 (SMTPS)	STARTTLS, SSL/TLS
POP	110	995 (POP3S)	SSL/TLS
IMAP	143	993 (IMAPS)	SSL/TLS

Best practice: Always use encrypted versions of email protocols (SMTPS, POP3S, IMAPS) to protect credentials and message content in transit.

Common Misconceptions

• Myth: SMTP retrieves emails from servers

  • Reality: SMTP only sends and relays; POP/IMAP retrieve messages

• Myth: Emails travel directly from sender's computer to recipient's computer

  • Reality: Emails always pass through mail servers

• Myth: Webmail and email clients work the same way

  • Reality: Webmail uses HTTP/HTTPS; clients use SMTP/POP/IMAP

• Myth: POP and IMAP can be used interchangeably

  • Reality: They have different behaviors regarding message storage and synchronization

• Myth: Port numbers are part of the application layer

  • Reality: Ports operate at the transport layer (Layer 4); protocols operate at Layer 7

Quick Reference Summary

When to use each protocol:

• SMTP: Sending outgoing mail from any client or relaying between servers
• POP: Single device, offline access, local storage preferred
• IMAP: Multiple devices, server-side storage, synchronization needed

OSI Layer positioning:

• Application Layer (7): SMTP, POP, IMAP protocols
• Transport Layer (4): TCP provides reliable delivery
• Network Layer (3): IP handles routing between servers

Learn More

Official Protocol Specifications:

• RFC 5321 – Simple Mail Transfer Protocol (SMTP)
• RFC 1939 – Post Office Protocol Version 3 (POP3)
• RFC 3501 – Internet Message Access Protocol (IMAP)

Additional Resources:

• RFC 5322 – Internet Message Format
• RFC 3207 – SMTP Service Extension for Secure SMTP over TLS
• ISO/IEC 7498-1 – OSI Model Reference