What is SMTP? How an Email Travels Across the Internet (MX, SPF, DKIM & DMARC Guide)

Sending an email from a web application feels effortless—you call resend.emails.send() or nodemailer.sendMail(), and two seconds later a verification code lands in the user's inbox.

Yet behind that single API call lies a 40-year-old distributed relay architecture involving TCP handshakes, DNS routing, and cryptographic signatures. If you don't understand how it works, your production password-reset emails will inevitably end up silently blocked or buried in the Spam folder.

1. What is SMTP (Simple Mail Transfer Protocol)?

First standardized in 1982 (RFC 821 / RFC 5321), SMTP is the internet's postal courier.

Crucially, SMTP is a push-only (sending and relaying) protocol—it is not used to read emails in your inbox!

• SMTP (Ports 587 TLS, 465 SSL, 25 Relay): Pushes outgoing mail from the sender's client/backend to the mail server, and relays it from the sender's mail server to the recipient's mail server.
• IMAP (Port 993): Synchronizes and reads emails stored on the receiving mail server across multiple devices (phone, laptop).
• POP3 (Port 995): Legacy protocol that downloads mail to a single device and typically deletes it from the server.

2. Step-by-Step Journey of an Email

When [email protected] sends an email to [email protected], four steps occur:

[1. Backend API] ──(SMTP Auth :587)──▶ [2. Outgoing MTA (SES / Resend / Postfix)]
                                                       │
                                        (DNS Query: "What is gmail.com's MX record?")
                                                       │
                                                       ▼
[4. User's Inbox] ◀──(IMAP :993)── [3. Gmail Inbound MX Server (Port :25 + TLS)]

1. Submission (MSA): Your Node.js/Go/PHP backend connects to your outgoing mail server over Port 587 (STARTTLS) and submits the message.
2. DNS MX Lookup: Your mail server asks DNS: "Where do I deliver mail for gmail.com?" DNS responds with the MX (Mail Exchange) records (e.g., gmail-smtp-in.l.google.com, Priority 5).
3. Server-to-Server Relay (MTA): Your mail server opens a connection to Gmail's MX server and runs an SMTP conversation (EHLO, MAIL FROM, RCPT TO, DATA).
4. Inbox Delivery (MDA / IMAP): If Gmail verifies the sender's authenticity, it places the message in the user's mailbox, where their phone reads it via IMAP.

3. Why Do Emails Go to Spam? (SPF, DKIM, and DMARC)

Because the original 1982 SMTP specification had zero built-in sender verification, anyone could spin up a server and claim MAIL FROM: <[email protected]>. To stop spoofing, modern mail providers (Gmail, Outlook) strictly enforce three DNS security records:

1. SPF (Sender Policy Framework)

A DNS TXT record listing which IP addresses and mail providers are officially authorized to send emails on behalf of your domain.

2. DKIM (DomainKeys Identified Mail)

Attaches a cryptographic digital signature (DKIM-Signature header) to every outgoing email using your private key. The receiving server fetches your public key from DNS (selector._domainkey.czay.dev) to verify that the email belongs to you and wasn't tampered with in transit.

3. DMARC (Domain-based Message Authentication, Reporting & Conformance)

Instructs the receiving server what to do if an email fails SPF and DKIM checks (p=none, p=quarantine -> send to Spam, or p=reject -> block completely).