Catalog
concept#Integration#Architecture#Platform#Security

Simple Mail Transfer Protocol (SMTP)

Standard protocol for exchanging and sending email between mail servers.

Simple Mail Transfer Protocol (SMTP) is the Internet standard for sending electronic mail between servers and from clients to mail servers.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

MTA (e.g., Postfix, Exim)MDA/IMAP/POP server for delivery and retrievalSpam and virus filters and DKIM/DMARC signer

Principles & goals

Separation of submission and relay for clear responsibility.Do not trust implicitly; always use authentication and encryption.Ensure compatibility with RFC standards to guarantee interoperability.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Misconfigured server can be abused as an open relay.
  • Unencrypted transmission allows eavesdropping and tampering.
  • Lack of authenticity leads to spoofing and reputation loss.
  • Enforce submission over port 587 with STARTTLS and AUTH.
  • Configure DKIM signatures, SPF policy and DMARC reporting.
  • Monitor queues, bounce rates and TLS coverage metrics.

I/O & resources

  • MIME message including envelope sender and recipient
  • DNS MX records and A/AAAA records
  • Network connectivity and port access (25/587)
  • Delivery confirmation or bounce message
  • SMTP response codes and server logs
  • Forwarded message to destination MTA

Description

Simple Mail Transfer Protocol (SMTP) is the Internet standard for sending electronic mail between servers and from clients to mail servers. It defines commands and response codes for message transmission, routing via MX records, and relaying policies. SMTP's simplicity enables interoperability but requires additional mechanisms for security and deliverability.

✔

  • Widely used, well‑documented protocol with high interoperability.
  • Simple text‑based protocol facilitates troubleshooting and logging.
  • Scalable via relays and queuing mechanisms.

✖

  • Originally designed without built‑in authentication or encryption.
  • Basic anti‑spam and deliverability validation are missing without extensions.
  • Lack of standardization for modern deliverability metrics within the protocol itself.

  • Delivery rate

    Share of successfully delivered messages relative to sent messages.

  • Bounce rate

    Share of permanently rejected messages (hard bounces).

  • Average delivery latency

    Time from send to successful delivery or final rejection.

RFC‑based deployment (Postfix/Sendmail)

Operating Postfix as MTA with standard SMTP configuration and TLS for MX delivery.

Authenticated submission for clients

Clients submit over port 587 with STARTTLS and AUTH to avoid open relay.

Cloud MTA relay for outbound email

Organization uses hosted SMTP relay for improved deliverability and IP reputation.

1

Install MTA (e.g., Postfix) and configure basic SMTP.

2

Create and verify DNS entries (MX, SPF, DKIM).

3

Enable TLS and authentication; set up monitoring and queue management.

⚠️ Technical debt & bottlenecks

  • Legacy MTA with outdated auth mechanisms still in use.
  • Missing automation for certificate rollovers.
  • No centralized view on reputation and deliverability metrics.
Spam filteringTLS terminationDNS configuration (MX/DKIM/SPF)
  • A server is abused as a spam relay due to missing authentication.
  • Bulk sending over port 25 leads to IP blacklisting.
  • Missing DKIM signatures severely reduce deliverability.
  • Assuming TLS alone solves spam problems.
  • Underestimating DNS propagation when testing MX changes.
  • Ignoring bounce feedback on high‑volume sends.
Mail server administration and MTA configurationDNS management (MX, SPF, DKIM, DMARC)Network and security fundamentals (TLS, ports, firewalls)
Deliverability and reputation (IP/domain reputation)Interoperability with RFC‑compliant MTAsSecurity (TLS, auth, DKIM/SPF/DMARC)
  • • Standard ports (25, 465, 587) and possible ISP blocks.
  • • Historical compatibility with legacy clients and servers.
  • • External dependency on DNS resolution and MX records.