SMTP Explained: Ports, Spoofing and SPF, DKIM, DMARC for Network+

SMTP — Simple Mail Transfer Protocol — is how email gets sent. That word matters, because the most common exam trap on this topic is confusing sending with retrieving.

SMTP pushes mail out. POP3 and IMAP pull mail down. One protocol for sending, two for receiving.

When you click Send, your client hands the message to a mail server over SMTP. That server finds the recipient's mail server and relays it there, again over SMTP. The message then sits in the recipient's mailbox until their client collects it — and that collection uses POP3 or IMAP, never SMTP.

The Ports

Port	Use	Encryption
25	Server-to-server relay	Opportunistic STARTTLS, historically none
587	Client submission — the modern standard	STARTTLS, authentication required
465	Client submission, implicit TLS	SMTPS — encrypted from the first byte
2525	Unofficial alternative	Varies — used when 25 is blocked

The distinction between 25 and 587 is worth understanding rather than memorizing. Port 25 is for servers talking to each other. Port 587 is for a user's mail client submitting a new message, and it requires authentication. Most residential ISPs and many cloud providers block outbound port 25 entirely to limit spam from compromised machines — which is why a mail client configured for port 25 often simply fails from home.

Note the difference in TLS style: STARTTLS begins as a plaintext connection and upgrades to encryption after a command, while implicit TLS on 465 is encrypted before anything else happens. Because STARTTLS starts in the clear, it is vulnerable to a stripping attack where an attacker in the middle removes the upgrade offer.

What a Session Looks Like

SMTP is a text-based command protocol, which is why an administrator can debug it by hand with telnet or openssl. A minimal exchange:

• HELO or EHLO — the client identifies itself. EHLO is the extended version and is what enables STARTTLS, authentication, and size limits.
• MAIL FROM — declares the sender, the envelope sender.
• RCPT TO — declares each recipient.
• DATA — the message headers and body follow, terminated by a lone full stop on its own line.
• QUIT — ends the session.

Responses are three-digit codes: 2xx success, 3xx more input needed, 4xx temporary failure (retry later), 5xx permanent failure. The 4xx versus 5xx distinction is worth knowing — a 451 means try again, a 550 means give up and bounce.

The Envelope Versus the Header

This is the single most useful thing to understand about SMTP from a security perspective.

The address in MAIL FROM — the envelope sender — is what the mail servers use for routing and bounces. The From: line the recipient actually sees is part of the message DATA, and nothing in SMTP requires the two to match.

That is the entire basis of email spoofing. The protocol was designed in 1982 for a trusted network and has no built-in authentication of the sender at all. Everything that addresses this was bolted on afterwards.

The Bolt-On Authentication Layer

• SPF — a DNS TXT record listing which IP addresses may send mail for the domain. Validates the envelope sender.
• DKIM — a cryptographic signature over the message, verified against a public key in DNS. Proves the message was not altered and came from an authorized system.
• DMARC — ties SPF and DKIM to the visible From: domain, requiring alignment, and tells receiving servers what to do on failure: none, quarantine, or reject. It also provides reporting.

The important limitation, and a likely exam point: these authenticate the domain, not the honesty of the sender. A lookalike domain that an attacker registered passes SPF, DKIM, and DMARC perfectly, because the attacker controls it.

Open Relays

An open relay is a mail server that will accept and forward mail from anyone to anyone. In the early internet this was normal; today it guarantees the server is found within hours, abused for spam, and blacklisted. A properly configured server relays only for authenticated users or for its own domains. If an exam scenario describes a mail server sending enormous volumes of mail nobody in the organization wrote, open relay is the answer.

Network+ (N10-009) Exam Tips

• SMTP sends; POP3 and IMAP receive. The most likely question on the topic.
• Ports 25, 587, and 465, and which is for relay versus client submission.
• POP3 110, POP3S 995, IMAP 143, IMAPS 993 — learn them alongside.
• POP3 versus IMAP: POP3 downloads and typically deletes from the server; IMAP keeps mail synchronized across devices.
• ISPs block outbound 25, which is a real troubleshooting cause.
• SMTP uses TCP.

Security+ and CySA+ Angles

Security+ (SY0-701) focuses on SPF, DKIM, and DMARC — what each does and that DMARC governs the visible From domain — plus spoofing, open relays, and mail gateway filtering.

CySA+ (CS0-004) expects header analysis: reading the Received chain from the bottom up to trace the real path, checking Authentication-Results, spotting a mismatch between Return-Path and From, and recognizing a lookalike domain that passed authentication legitimately.

Key Takeaways

• SMTP sends mail; POP3 and IMAP retrieve it.
• Port 25 for server relay, 587 for authenticated client submission, 465 for implicit TLS.
• It is a plaintext command protocol with numeric response codes — 4xx retry, 5xx permanent.
• The envelope sender and the visible From line need not match, which is why spoofing works.
• SPF, DKIM and DMARC were added later and authenticate the domain, not the sender's intent.
• An open relay will be abused within hours and blacklisted.