SMTP

When two computers on the internet talk to each other, they need fixed rules for doing so. Such sets of rules are called protocols: they define who is allowed to say what and when. SMTP is the protocol for sending emails. The abbreviation stands for Simple Mail Transfer Protocol. It regulates how your mail program hands a message over to a sending computer and how that computer forwards it to the recipient’s computer. Fetching and reading the mail, however, is not SMTP’s job.

Why every email takes this detour

Email works worldwide even though no one runs it centrally. Google, a company server in Stuttgart, and a small provider in Brazil belong to different people. Yet messages arrive between them. The reason is that everyone follows the same shared language. That is exactly what SMTP has been doing since the early 1980s.

This openness is at the same time its biggest problem. The original protocol does not check whether a sender really is who they claim to be. You can write almost any sender address you like into an email. This is the basis for spam and phishing, meaning forged emails meant to steal passwords or money. Estimates suggest that more than half of worldwide email traffic is unwanted bulk mail.

For this reason, verification procedures were added afterward. They are called SPF, DKIM, and DMARC. Put simply, the owner of a domain publicly records which servers are allowed to send on its behalf. The recipient can look this up and filter out suspicious emails.

The dialogue between two mail servers

SMTP is a text protocol. The two computers exchange short commands in readable letters, not incomprehensible blocks of data. The sending computer announces itself with HELO or EHLO. Then it names the sender with MAIL FROM and the recipient with RCPT TO. Only after that does the actual text of the message follow with DATA.

The other side responds to every command with a three-digit number. 250 means “OK,” 550 means “recipient unknown.” This is reminiscent of a terse radio conversation: short statement, short confirmation, next step. If you get an error message back, the numeric code usually comes directly from this exchange.

The division of labor with other protocols is important. SMTP only brings the mail as far as the recipient’s mailbox. So that you can read it on your phone and laptop, IMAP or POP3 come into play. A comparison: SMTP is the mail carrier, IMAP is the key to your mailbox. Modern connections are additionally encrypted so that no one can read along in transit.

SMTP in everyday life and in software projects

You encounter the term as soon as you set up a mail account by hand. There, the program asks for an incoming mail server and an outgoing mail server. The outgoing mail server is the SMTP server, usually on port 587 with a password prompt. Without this setting, you can receive emails but not send any.

In the tech industry, SMTP mainly shows up behind automated messages. Order confirmations, password links, and system alerts are sent by programs via SMTP. Services like Amazon SES, Postmark, or Mailgun sell exactly that as a product. Even AI assistants that send emails on their own ultimately rely on this same old technology.

A common misconception is that SMTP is a program or an app. It is only an agreement about how computers talk to each other. Programs like Postfix or Exim implement this agreement. And a second misconception: SMTP is not outdated—it is in operation billions of times a day.