How Email Works
How email travels from sender to inbox — SMTP delivery, IMAP retrieval, DNS mail routing, message headers, spam filtering, and authentication standards.
Email works by relaying text messages between servers using standardized protocols: SMTP sends mail from client to server and between servers, while IMAP or POP3 lets recipients retrieve it. Each message hops through a chain of mail servers addressed by domain, arriving in the recipient's mailbox within seconds.
SMTP, IMAP, and POP3: the email protocols
Email runs on a small family of open protocols. SMTP (Simple Mail Transfer Protocol) sends messages: your client submits mail to your provider's SMTP server, which relays it toward the recipient's server. Retrieval is a separate job handled by IMAP (which keeps mail on the server and syncs state across your devices) or the older POP3 (which typically downloads and deletes). Webmail hides these protocols behind a browser page, but underneath, SMTP delivery and IMAP storage still do the work. Like nearly all internet communication, email connections begin with the TCP three-way handshake, and finding the recipient's mail server starts with a DNS lookup for MX records.
The journey of an email message
Sending an address like [email protected] splits into a mailbox name and a domain; the sender's server queries DNS for that domain's mail exchangers and connects to the highest-priority one. The message — headers plus body — transfers over SMTP, possibly hopping through spam filters and relays, until it lands in the recipient's mailbox store. A minimal message looks like this:
From: [email protected]
To: [email protected]
Subject: Hello
Date: Sat, 03 Oct 2026 09:00:00 +0000
The body follows the blank line.
Headers record every hop (Received lines), enabling diagnosis when mail goes missing. Delivery usually takes seconds, but each server may queue and retry for days if the next hop is unreachable. Temporary failures produce delayed-delivery notices; permanent failures return the message to the sender as a bounce.
Spam, spoofing, and authentication
Because classic SMTP trusts senders to identify themselves honestly, anyone could forge a From address — the root of spam and phishing. Three authentication standards now fight back: SPF lets a domain publish which servers may send its mail, DKIM attaches a cryptographic signature proving the message is unaltered, and DMARC tells receivers what to do when checks fail. Large providers also filter with reputation scores and content analysis, diverting suspicious mail to spam folders. Encryption in transit (STARTTLS) protects hops between servers, while end-to-end tools like PGP protect content itself — a different layer from the web encryption described in HTTP and HTTPS.