Skip to content

Simple Mail Transfer Protocol(SMTP)

Also called: SMTP relay · SMTP server · Email relay

Definition
The protocol mail servers use to relay email from sender to recipient, with commands such as MAIL FROM, RCPT TO and DATA, and STARTTLS for encryption.

Exhibit A

Step through one SMTP conversation

10 / 10
  • Sending serveryour relay
  • DNSMX records
  • Receiving servermx1.example.in

Step 10 of 10Request

Sending serverReceiving server

QUIT

221 Bye. Pooled senders reuse the session for more messages instead.

  • Request — solid arrow — a call that expects an answer
  • Response — dashed arrow — the answer coming back
From the MX lookup to the final 250: each step is one command or reply between the sending server and the recipient's mail server. Select a step to see what it means.

Step 10 of 10: Sending server to Receiving server — QUIT. 221 Bye. Pooled senders reuse the session for more messages instead.

What is SMTP?

Simple Mail Transfer Protocol (SMTP) is the protocol that carries email across the internet. A sending server opens a TCP connection to the receiving domain's mail server (found through its MX records in DNS), and the two exchange short text commands and three-digit replies until the message has been handed over. The current specification is RFC 5321; the format of the message itself (headers such as From, To and Subject, then the body) is defined separately in RFC 5322.

A session follows a fixed script. The client greets with EHLO and learns which extensions the server supports, upgrades the connection to TLS with STARTTLS, names the envelope sender with MAIL FROM, names each recipient with RCPT TO, then sends DATA, the headers and body, and a line containing only a full stop. A 250 reply at that point means the receiving server has accepted responsibility for the message. Replies starting with 4 are temporary (try again later); replies starting with 5 are permanent failures that come back to the sender as an email bounce.

Applications meet SMTP in two places. To send, they submit mail to a relay, their own mail server or an email provider, on port 587 with STARTTLS and AUTH, or port 465 with TLS from the first byte; the relay then delivers it onward on port 25. The alternative is an HTTP email API, where one HTTPS request replaces the whole conversation and delivery events come back as webhooks. Either way, SMTP is only the transport: SPF, DKIM and DMARC are what prove the mail really came from your domain.

Key takeaways

  • SMTP (Simple Mail Transfer Protocol) is the text-based protocol email servers use to hand messages to each other, defined in RFC 5321.
  • A session runs EHLO, optional STARTTLS, MAIL FROM, RCPT TO, DATA and QUIT; each command gets a three-digit reply code.
  • Use port 587 with STARTTLS (or 465 with implicit TLS) to submit mail; port 25 is for server-to-server relay and is often blocked on cloud hosts.
  • 4xx replies are temporary and should be retried; 5xx replies are permanent and should suppress the address.
  • SMTP only moves mail. SPF, DKIM and DMARC prove who sent it and decide whether it lands in the inbox.

SMTP in code

S: 220 mx1.example.in ESMTP ready
C: EHLO mail.shop.example
S: 250-mx1.example.in
S: 250-SIZE 52428800
S: 250-8BITMIME
S: 250 STARTTLS
C: STARTTLS
S: 220 2.0.0 Ready to start TLS
   ... TLS handshake, then EHLO again ...
C: MAIL FROM:<bounce@shop.example>
S: 250 2.1.0 OK
C: RCPT TO:<priya@example.in>
S: 250 2.1.5 OK
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
C: From: Shop <orders@shop.example>
C: To: priya@example.in
C: Subject: Invoice INV-48213
C:
C: Your invoice is attached.
C: .
S: 250 2.0.0 OK queued as 4F2A9C
C: QUIT
S: 221 2.0.0 Bye

C is the sending client, S the receiving server. The envelope (MAIL FROM, RCPT TO) is separate from the From and To headers.

How does SMTP work?

  1. Find the receiving server

    The sending server looks up the MX records of the recipient's domain and connects to the host with the lowest preference value, falling back to the next if it is unavailable.

  2. Greet and secure the connection

    The server announces itself with 220. The client sends EHLO with its own hostname, sees STARTTLS among the advertised extensions, upgrades to TLS and greets again over the encrypted channel.

  3. Name the envelope

    MAIL FROM:<bounce@shop.example> sets the envelope sender, where bounces go and the domain SPF checks. One RCPT TO:<…> per recipient follows; each can be accepted (250) or refused (550) on its own.

  4. Send the content

    After DATA and a 354 reply, the client streams headers (including the DKIM signature) and body, ending with a line holding a single full stop. A 250 reply with a queue ID completes the hand-off.

  5. Close, retry or bounce

    QUIT ends the session. If a reply was 4xx, the sender queues the message and retries under a retry policy with backoff for hours or days; a 5xx reply ends delivery and generates a bounce.

Common mistakes with SMTP

  • Confusing the envelope with the headers

    MAIL FROM (the envelope sender, later the Return-Path) and the From: header can differ. SPF checks the envelope domain and DMARC checks the header domain, so both must be domains you control and have authenticated.

  • Sending from a cloud server on port 25

    Many cloud providers block outbound port 25 to fight spam, so connections simply time out. Submit to an authenticated relay on 587 or 465 instead.

  • Treating every error the same

    Retrying a 5xx wastes reputation, and dropping a 4xx loses mail. Retry 4xx replies with exponential backoff; suppress addresses that return 5xx and record the enhanced status code.

  • Letting TLS be optional

    Opportunistic STARTTLS can be stripped by an attacker on the path, exposing credentials. For submission, require TLS and verify the certificate, as requireTLS and ssl.create_default_context() do above.

Why does SMTP matter?

Transactional email (receipts, password resets, statements) is still the channel every customer has, sits beside SMS and WhatsApp in most CPaaS stacks, and usually fails quietly. Knowing what happens in the SMTP session tells a developer why a message bounced, why the cloud server cannot reach port 25, why the envelope sender differs from the From address, and when to retry rather than give up. It also frames a practical decision: plain SMTP relay, which works with any library and legacy system, or an HTTP API with webhooks for opens, bounces and complaints.

Example: An Indore SaaS fixes its invoice mail

An Indore billing startup sends invoices from its app server straight to customers' mail servers on port 25. After moving to a cloud host, every send times out: the provider blocks outbound port 25. The team switches to submitting through an authenticated relay on port 587 with STARTTLS, which delivers onward on its behalf. Bounce handling improves too: the app now retries 451 replies with backoff, stops mailing addresses that return 550 5.1.1 (no such user), and sets the envelope sender to a bounce subdomain whose SPF record lists the relay.

Best practices for SMTP

  • Use a dedicated bounce subdomain as the envelope sender so bounce processing and SPF stay separate from your main domain.
  • Pool connections and send several messages per session when volumes are high; a new TLS handshake per email is slow.
  • Log the server's final reply and queue ID for each message; it is the receipt support needs.
  • Pick an HTTP email API when you want delivery, bounce and complaint webhooks without parsing SMTP replies yourself.
  • In an omnichannel orchestration setup, treat a hard bounce like an undelivered SMS: switch that customer to another channel rather than retrying email.

SMTP FAQs

Which SMTP port should I use: 25, 465 or 587?+
Use 587 with STARTTLS, or 465 with implicit TLS, to submit mail from an application. Port 25 is for relay between mail servers; most applications should not use it, and many networks and cloud hosts block it outbound.
What is the difference between SMTP relay and an email API?+
Both deliver the same email; they differ in how your app talks to the provider. SMTP relay is a multi-step text conversation any mail library supports, while an HTTP email API accepts one HTTPS request with JSON and usually returns delivery, bounce and complaint events by webhook.
Is SMTP encrypted?+
Only when TLS is used. STARTTLS upgrades a plain connection and implicit TLS on port 465 encrypts from the start; between mail servers, encryption is often opportunistic, which is why standards such as MTA-STS exist to require it.
Does SMTP prove who sent an email?+
No. SMTP lets a client claim any sender address. Receiving servers rely on SPF, DKIM and DMARC to check whether the sending server and the signature are authorised by the domain in the From address.

See InfiQ pricing

Try it on the official WhatsApp Business API

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms