What Is SMTP? How an Email Gets From Sender to Inbox

SMTP (Simple Mail Transfer Protocol) is the standard that email software uses to hand a message on to the next server. It carries mail from your app to your provider, then between servers until it reaches the recipient's mail server.

It only sends. Reading mail in an inbox uses other protocols, IMAP (Internet Message Access Protocol) or POP3 (Post Office Protocol).

A quote sent from an office laptop to a client changes hands several times, and each server leaves a dated Received line in the header. Those lines show the route, and where a late email was held.

How the SMTP conversation works

In an SMTP conversation, the sending machine (the SMTP client) sends short commands and the receiving one (the SMTP server) answers each with a three-digit code. The rules were first published in 1982 as Request for Comments (RFC) 821.

The RFC series is where internet standards are published, and the current version of SMTP is RFC 5321, from October 2008.

Here is a shortened conversation between two mail servers, modelled on the one in RFC 5321. S is the server taking the message and C is the one sending it.

This example and the header later in the article use invented names ending in .example, a domain set aside for documentation (RFC 2606). Their addresses come from ranges kept for the same purpose (RFC 5737).

S: 220 mx.riverside.example ready
C: ehlo out2.mailhost.example
S: 250-mx.riverside.example greets out2.mailhost.example
S: 250 STARTTLS
C: mail from:<[email protected]>
S: 250 Ok
C: rcpt to:<[email protected]>
S: 250 Ok
C: data
S: 354 Send the message, then a line with a single full stop
C: From: Oakfield Joinery <[email protected]>
C: To: Riverside Accounts <[email protected]>
C: Subject: Quote for the oak staircase
C:
C: Hello, the quote is attached.
C: .
S: 250 Ok, queued as 7Hc1Kd3R
C: quit
S: 221 Bye

The 220 line is the server's greeting. The client answers with ehlo, short for extended hello, which marks it as speaking ESMTP (extended SMTP). The server then lists the optional features it supports, here STARTTLS for encryption.

Each 250 means the step was accepted. The 354 asks for the message itself.

The mail from and rcpt to lines are the envelope. Servers deliver the message to the rcpt to address. Any failure report goes to the mail from address, which later appears in the header as the Return-Path.

The From, To and Subject lines after data are the letter the reader sees. Servers route by the envelope, so a Bcc copy can arrive without its address appearing anywhere in To.

The final 250 is a handover. From that reply on, RFC 5321 makes the receiving server responsible for the email. It must deliver it or report the failure.

The example skips STARTTLS to stay short. The real hop was encrypted, so its Received line further down says ESMTPS.

How an email travels: submission, relay and delivery

An email reaches its recipient in three stages: submission into your provider, relay between mail servers and delivery into a mailbox. The Internet Mail Architecture, RFC 5598 (2009), names the software that does each job.

Step	Role	What it does	In the example
Writing	Message user agent (MUA)	The program you write and read in, such as Outlook, Apple Mail, a phone app or webmail	A laptop at oakfield.example
Submission	Mail submission agent (MSA)	Accepts new mail from a signed-in user, checks the addresses and takes charge of it	smtp.mailhost.example
Relay	Message transfer agent (MTA), also called a mail transfer agent	Moves the message one server closer, using the recipient domain's MX (mail exchange) record to find the next one	out2.mailhost.example, then mx.riverside.example
Delivery	Mail delivery agent (MDA)	Files the message in the recipient's mailbox, applying any filter rules	mbox.riverside.example

Submission is the step your settings screen controls. The MSA is the server your mail program, printer or website form connects to. Under RFC 6409, it must by default refuse new mail from anyone who has not signed in.

Relay is the part most people picture as SMTP. Your provider's MTA looks up the recipient domain's MX record, connects to the server it names and holds the conversation shown above.

RFC 5598 compares an MTA to a router. It moves the message one hop closer without changing the envelope or rewriting the content. If the next server is busy or down, the message waits in a queue and is tried again later.

Any server that takes mail in and hands it to another SMTP server is a relay. An SMTP relay service sells that job to businesses. Your app or office printer hands its mail to the service, which relays it to each recipient's server.

Delivery is the last handover. At the recipient's end, the MX server gives the message to the MDA, often over LMTP (Local Mail Transfer Protocol). That is a close relative of SMTP, built for the final step into a mailbox store (RFC 2033).

Up to this point every step is a push: the server holding the message starts the next transfer (RFC 5598).

Webmail changes only the first step. In Gmail or Outlook in a browser, the browser talks to the provider over the web. SMTP starts when the provider passes the message on.

How to read the route in Received lines

Every SMTP server that accepts a message must add a Received line to the top of its header (RFC 5321, section 4.4). No server may change or remove the lines already there. Read from the bottom up, they show the route.

The header below continues the example and follows the RFC 5321 format.

Received: from mx.riverside.example (mx.riverside.example [198.51.100.7])
        by mbox.riverside.example with LMTP id 5Qp2Lw8a
        for <[email protected]>; Thu, 22 Oct 2026 10:14:09 +0100
Received: from out2.mailhost.example (out2.mailhost.example [203.0.113.52])
        by mx.riverside.example with ESMTPS id 7Hc1Kd3R
        for <[email protected]>; Thu, 22 Oct 2026 10:14:08 +0100
Received: from smtp.mailhost.example (smtp.mailhost.example [203.0.113.10])
        by out2.mailhost.example with ESMTPS id 2Fv8Nq6T
        for <[email protected]>; Thu, 22 Oct 2026 10:14:07 +0100
Received: from [192.168.1.20] (host44.broadband.example [192.0.2.44])
        by smtp.mailhost.example with ESMTPSA id 9Lm4Rx1W
        for <[email protected]>; Thu, 22 Oct 2026 10:14:06 +0100

The bottom line is submission, from the laptop to the MSA. The two lines above it are relay: first inside the provider, then across the internet to Riverside's MX server. The top line is delivery into the mailbox.

The second line is the hop from the conversation above. Its ID, 7Hc1Kd3R, also appears in the last 250 reply of that conversation.

Part	What it records	In the bottom line
from	The name the sending machine gave in ehlo, then in round brackets what the receiving server found from the connection: a name and an address	The laptop called itself [192.168.1.20], a private office address. The server saw 192.0.2.44 and looked up the name registered for it, host44.broadband.example
by	The server that wrote the line	smtp.mailhost.example, the submission server
with	The protocol. ESMTP gains an S when the hop was encrypted and an A when the sender signed in	ESMTPSA: encrypted and signed in
id	The receiving server's own reference for the message, used in its logs	9Lm4Rx1W
for	The recipient this copy was addressed to	[email protected]
Date	When that server received the message	10:14:06, British Summer Time (+0100)

The S and A suffixes are registered in RFC 3848. Only the bottom line carries an A. The laptop signed in to send, while servers relaying to each other normally do not.

Our post on reading email headers shows how to open these lines in Gmail or Outlook and read delays and forgeries from them.

What an SMTP server is

An SMTP server is any mail server that accepts email over SMTP, so the phrase covers two different machines on the route.

Software that asks for one, such as a printer, a plugin or a mail program, wants the outgoing server. That is your provider's submission server, such as smtp.gmail.com, and it needs your sign-in and a port, usually 587 or 465.

The other is the incoming server named in a domain's MX record. It takes mail from other servers on port 25, without a sign-in.

SMTP vs IMAP and POP3

A mail app asks for two servers because SMTP only sends. The outgoing server takes your mail and starts it on the route above, while the incoming one lets the app read what has arrived, over IMAP or POP3. Reading leaves no Received line, because the message is not handed to another mail server.

Is SMTP secure?

SMTP on its own is not secure: it was published with no encryption and no sender check, and both were added later. Each addition covers only part of the problem.

Email encryption in transit and end to end are different protections: securing a connection does not lock the message inside the recipient's mailbox.

STARTTLS (RFC 3207, 2002) lets two servers switch to an encrypted connection, but only for the hop between them. The standard warns that SMTP is "not an end-to-end mechanism", so one encrypted pair does not make the whole route private.

SMTP itself still does not check the sender, so anyone can type your address into mail from or From. Receiving servers catch that with SPF, DKIM and DMARC, the sender authentication records a domain publishes.

Microsoft is not phasing out SMTP. It is ending password sign-in, called Basic authentication, for SMTP AUTH (sending through a mailbox from an app or device) in Exchange Online.

Microsoft is switching it off by default for existing organisations at the end of December 2026. Administrators can turn it back on, and OAuth (sign-in with a token instead of a password) is the supported method (Exchange Team Blog, January 2026).

Where a MailGraf campaign joins the route

A MailGraf campaign leaves from the platform rather than from your laptop, so the sender check above is the part you set up. Connect a subdomain for sending, and MailGraf looks after its SPF, DKIM and DMARC records, the ones receiving servers check to confirm a campaign really comes from your domain (Add a sending domain).