Email: SMTP, POP3 and IMAP

Three components, and one job each#

The mail system has three moving parts, and naming them correctly makes the rest of the topic straightforward:

Every mail server keeps two things for each user: a mailbox holding messages that have arrived, and a message queue holding messages waiting to go out. Both matter in an answer, because a message spends time sitting in each.

Vocabulary, before anything uses it#

The journey, leg by leg#

Take a message from one person to another and count the arrows. There are three, and each one is a separate question about which protocol runs on it.

sender’s agent → sender’s server → recipient’s server → recipient’s agent

1. Leg 1, agent to own server. The sender composes the message and hands it to their own mail server, which puts it in the outgoing message queue. This leg uses SMTP when the sender is running a mail client — and HTTP when the sender is using webmail in a browser, because then the composing happens on a web page.
2. Leg 2, server to server. The sending server opens a TCP connection directly to the recipient’s mail server on port 25 and pushes the message across. This leg is always SMTP. There is no intermediate mail server and no store-and-forward chain in the normal case — it is a direct transfer.
3. Leg 3, server to recipient’s agent. The recipient’s server puts the message in their mailbox, where it sits until the recipient asks for it. Retrieving it uses a mail access protocol — POP3 or IMAP — or HTTP if the recipient uses webmail.

Where the message physically sits along the way is worth stating too: in the sender’s outgoing queue after leg 1, and in the recipient’s mailbox after leg 2, possibly for days. A good answer mentions both, because they are why the recipient does not have to be online when the message is sent.

SMTP itself#

SMTP uses TCP for reliable transfer, on port 25 for server-to-server. A transfer has three phases: handshaking, then transfer of messages, then closure. The interaction is command and response in ASCII text, with numeric status codes — structurally very like HTTP.

S: 220 mail.example.com ESMTP ready
C: HELO relay.example.org
S: 250 Hello relay.example.org
C: MAIL FROM: <alice@example.org>
S: 250 OK
C: RCPT TO: <bob@example.com>
S: 250 OK
C: DATA
S: 354 End data with .
C: From: alice@example.org
C: To: bob@example.com
C: Subject: Lunch
C:
C: Are you free Thursday?
C: .
S: 250 Message accepted
C: QUIT
S: 221 Closing connection

Three properties get examined, and all three are visible above:

• SMTP uses persistent connections. One TCP connection can carry several messages to the same server.
• Base SMTP requires 7-bit ASCII, header and body alike. Anything else — an image, an accented character — has to be encoded into ASCII first.
• The end of a message is marked by a line containing a single dot. There is no length field, so the dot on its own line is the terminator.

The comparison with HTTP is a standard exam question, and it has a clean answer:

POP3 and IMAP, and why the difference matters#

Both let a user agent retrieve mail from the user’s own server. They differ in where the messages end up living, and that one difference produces every other difference.

POP3 runs in two phases. In authorization, the client sends user and pass, and the server answers +OK or -ERR. In the transaction phase the client issues list, retr, dele and finally quit.

S: +OK POP3 server ready
C: user bob
S: +OK
C: pass hungry
S: +OK user successfully logged on
C: list
S: 1 498
S: 2 912
S: .
C: retr 1
S: <message 1 contents>
S: .
C: dele 1
C: quit
S: +OK POP3 server signing off

POP3 can run in download-and-delete mode, which removes each message from the server, or download-and-keep, which leaves it. Download-and-delete has a consequence people meet in real life: read your mail on the desktop, and it is not on the phone. And POP3 is stateless across sessions — it remembers nothing once you disconnect, so folders you make in one client mean nothing to another.

IMAP takes the opposite position: messages stay on the server. The user organises them into folders that live on the server, and IMAP keeps user state across sessions — folder names, and which message is in which folder. Every device sees the same mailbox, because there is only one mailbox.

Worked example#

Step 1 — Draw four endpoints and three arrows before naming anything. Sender’s host, sender’s mail server, recipient’s mail server, recipient’s host. Do not start writing protocol names until the arrows are on the page; naming before drawing is how legs get merged.

Step 2 — Label each arrow from what that end is running. The sender is in a browser, so leg 1 is a web transaction. Leg 2 is server to server, which is always the transfer protocol. The recipient is running a client configured for POP3, so leg 3 is that.

HTTP  →  SMTP  →  POP3

Step 3 — Say what each protocol did, not just its name. HTTP carried the composed message from the browser to the sender’s mail server, which queued it. SMTP pushed it over a direct TCP connection to the recipient’s mail server, which placed it in the mailbox. POP3 let the recipient’s client download it from that mailbox when the recipient chose to look.

Step 4 — Mention where it waited. In the sender’s outgoing queue, and then in the recipient’s mailbox until retrieval. That is why the recipient need not be online when it is sent.

Practice#

1. Name the three components of the email system and give each one job.
2. Which protocol runs between two mail servers, and what port does it use?
3. A sender uses a desktop mail client and the recipient uses IMAP. Name the protocol on each of the three legs.
4. Why is SMTP described as a push protocol and HTTP as a pull protocol?
5. How does an SMTP server know a message body has ended?
6. What is the difference between MAIL FROM: and the From: line, and what does that difference make possible?
7. A user reads mail on a laptop and then opens their phone to find the message missing. Which access protocol and which mode explains that, and what would have prevented it?
8. Give two things IMAP does that POP3 does not, and name the single underlying difference they come from.
9. Someone writes “the message travels from Alice to Bob by POP3.” Correct it in one sentence.

Solutions#

1. User agents, mail servers, SMTP. The user agent lets a person compose, edit and read messages. The mail server holds each user’s mailbox for incoming mail and a message queue for outgoing mail. SMTP transfers messages from one mail server to another.
2. SMTP on port 25. SMTP, over TCP on port 25 for server-to-server transfer. A mail client submitting a new message to its own server normally uses port 587 instead.
3. SMTP, SMTP, IMAP. Leg 1, client to own server: SMTP, because the sender is using a mail client rather than a browser. Leg 2, server to server: SMTP. Leg 3, server to recipient: IMAP.
4. Who initiates the transfer. SMTP pushes because the machine that has the message opens the connection and sends it to the machine that will store it. HTTP pulls because the machine that wants the object opens the connection and asks for it. The difference is which end takes the initiative, not the direction the bytes travel.
5. A line containing a single dot. The client sends a line containing only a dot — the CRLF.CRLF sequence. SMTP has no length field, so that line is the terminator.
6. Envelope versus message content, which enables forgery. MAIL FROM: is an SMTP command that tells the receiving server where the message came from for delivery purposes — the envelope. From: is a line inside the message, which is what the recipient’s mail reader displays. Nothing forces them to match, which is what makes a forged sender address possible.
7. POP3 in download-and-delete mode. POP3 in download-and-delete mode: the laptop retrieved the message and removed it from the server, so the phone had nothing to fetch. Download-and-keep mode would have left a copy, and IMAP would have avoided the problem entirely by never moving the message off the server.
8. Server-side folders and cross-session state, from keeping messages on the server. IMAP lets a user organise messages into folders that live on the server, and it keeps user state across sessions, including folder names and which message is in which folder. Both follow from the one underlying difference: IMAP keeps messages on the server, while POP3 downloads them to the client.
9. POP3 does not move mail between hosts. The message travels from the sender’s mail server to the recipient’s mail server by SMTP; POP3 is only what the recipient’s client uses afterwards to retrieve it from their own mailbox.

Test-readiness checklist#

• ☐  I can draw the four endpoints and three arrows before naming a single protocol.
• ☐  I can name the protocol on each leg for any combination of client and webmail at either end.
• ☐  I can say why SMTP is push and HTTP is pull in terms of who initiates.
• ☐  I can name the three phases of an SMTP transfer.
• ☐  I can state the 7-bit ASCII rule and the dot-line terminator.
• ☐  I can tell an SMTP command apart from a message header line, and say why that gap matters.
• ☐  I can give the POP3 command sequence for both phases.
• ☐  I can rebuild the POP3-versus-IMAP table from the one sentence that generates it.
• ☐  I can say where the message is stored between legs, and why the recipient need not be online.

Frequently asked questions#

Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written.