Skip to content
My Docs

Smtp Pop3 Imap Email Protocols

Category: Transport and Application Layer Protocols
Type: Network Concepts
Generated on: 2025-07-10 08:57:34
For: Network Engineering, Administration & Technical Interviews

SMTP, POP3, IMAP: Email Protocols Cheatsheet

Section titled “SMTP, POP3, IMAP: Email Protocols Cheatsheet”

This cheatsheet provides a comprehensive overview of SMTP, POP3, and IMAP, the core protocols for email communication. It covers their key concepts, operation, troubleshooting, and practical applications, making it suitable for both students and professionals.

  • SMTP (Simple Mail Transfer Protocol): Used for sending email between mail servers and from clients to mail servers. Think of it as the postal service for email.
  • POP3 (Post Office Protocol version 3): Used for retrieving email from a mail server to a client. Downloads emails and typically deletes them from the server (but this is configurable). Think of it as picking up mail from your PO Box, usually emptying it.
  • IMAP (Internet Message Access Protocol): Used for retrieving email from a mail server to a client. Keeps emails on the server and allows clients to manage them remotely. Think of it as accessing your online email account.

Why are they important in networking?

These protocols are fundamental to email communication, a critical service in modern networking. Understanding them is crucial for network administrators, developers, and security professionals. They are the backbone of email delivery, storage, and user access.

ConceptDescription
MUAMail User Agent (e.g., Outlook, Thunderbird, Gmail app). The email client application used by end-users.
MTAMail Transfer Agent (e.g., Sendmail, Postfix, Exim). The mail server software responsible for routing and delivering email.
MSAMail Submission Agent. A specific MTA that accepts email from MUAs for relaying. Usually requires authentication.
MDAMail Delivery Agent. The MTA component responsible for delivering email to a user’s mailbox on the server.
EnvelopeContains sender, recipient, and other routing information. Not part of the email message itself.
HeaderContains metadata about the email (e.g., From, To, Subject, Date). Part of the email message.
BodyThe actual content of the email message. Part of the email message.
Port NumbersSMTP: 25 (unencrypted), 587 (submission), 465 (deprecated SMTPS); POP3: 110 (unencrypted), 995 (POP3S); IMAP: 143 (unencrypted), 993 (IMAPS)
AuthenticationVerifying the identity of the sender or receiver. Common methods include username/password, TLS/SSL certificates, and OAuth.
TLS/SSLTransport Layer Security/Secure Sockets Layer. Protocols used to encrypt communication between clients and servers, protecting sensitive information like passwords.
STARTTLSA command used to upgrade an unencrypted SMTP connection to an encrypted TLS connection.
Base64 EncodingEncoding binary data into an ASCII string format for transmission over SMTP.
MIMEMultipurpose Internet Mail Extensions. An internet standard for handling various media types (e.g., images, attachments) in email.

SMTP

Section titled “SMTP”
  1. Connection: The client (MUA) connects to the server (MSA/MTA) on port 25 (or 587/465).
  2. Greeting: The server sends a greeting (e.g., 220 example.com ESMTP Postfix).
  3. EHLO/HELO: The client sends an EHLO (Extended HELO) or HELO command to identify itself. EHLO is preferred as it supports extensions.
  4. Authentication (Optional): The client may authenticate using the AUTH command.
  5. MAIL FROM: The client specifies the sender’s email address.
  6. RCPT TO: The client specifies the recipient’s email address. Multiple RCPT TO commands can be used for multiple recipients.
  7. DATA: The client indicates that it will send the email data.
  8. Email Data: The client sends the email headers and body, terminated by a line containing only a period (.).
  9. Confirmation: The server confirms receipt of the email data.
  10. QUIT: The client closes the connection.
+-------+     25/587/465    +-----------+
|  MUA  |-------------------|   MSA/MTA |
+-------+     SMTP          +-----------+
     |                       |
     | EHLO/HELO            |
     |--------------------->|
     |                       |
     |<---------------------| 250 OK
     |                       |
     | AUTH (Optional)      |
     |--------------------->|
     |                       |
     |<---------------------| 235 Authentication Successful
     |                       |
     | MAIL FROM: <sender>   |
     |--------------------->|
     |                       |
     |<---------------------| 250 OK
     |                       |
     | RCPT TO: <recipient> |
     |--------------------->|
     |                       |
     |<---------------------| 250 OK
     |                       |
     | DATA                 |
     |--------------------->|
     |                       |
     |<---------------------| 354 End data with <CR><LF>.<CR><LF>
     |                       |
     | <Email Headers/Body> |
     |--------------------->|
     |                       |
     | .                    |
     |--------------------->|
     |                       |
     |<---------------------| 250 OK
     |                       |
     | QUIT                 |
     |--------------------->|
     |                       |
     |<---------------------| 221 Bye
     |                       |
+-------+                   +-----------+

POP3

Section titled “POP3”
  1. Connection: The client (MUA) connects to the server on port 110 (or 995).
  2. Greeting: The server sends a greeting (e.g., +OK POP3 server ready).
  3. USER: The client sends the username.
  4. PASS: The client sends the password.
  5. Authentication: The server authenticates the user.
  6. STAT: The client requests the number of messages and total size.
  7. LIST: The client requests a list of message sizes.
  8. RETR: The client retrieves a specific message by its number.
  9. DELE: The client marks a message for deletion. (Only deleted upon QUIT)
  10. QUIT: The client closes the connection, and messages marked for deletion are deleted.
+-------+     110/995     +-----------+
|  MUA  |-------------------|   POP3    |
+-------+     POP3          +-----------+
     |                       |
     | USER <username>      |
     |--------------------->|
     |                       |
     |<---------------------| +OK User accepted
     |                       |
     | PASS <password>      |
     |--------------------->|
     |                       |
     |<---------------------| +OK Password accepted
     |                       |
     | STAT                 |
     |--------------------->|
     |                       |
     |<---------------------| +OK <num_messages> <total_size>
     |                       |
     | LIST                 |
     |--------------------->|
     |                       |
     |<---------------------| +OK <message_number> <message_size>
     |                       | (Repeated for each message)
     |                       | .
     |                       |
     | RETR <message_number>|
     |--------------------->|
     |                       |
     |<---------------------| +OK <message_size> octets
     |                       | <message_data>
     |                       | .
     |                       |
     | DELE <message_number>|
     |--------------------->|
     |                       |
     |<---------------------| +OK Message marked for deletion
     |                       |
     | QUIT                 |
     |--------------------->|
     |                       |
     |<---------------------| +OK POP3 server signing off
     |                       |
+-------+                   +-----------+

IMAP

Section titled “IMAP”
  1. Connection: The client (MUA) connects to the server on port 143 (or 993).
  2. Greeting: The server sends a greeting (e.g., * OK [CAPABILITY IMAP4rev1 ...]).
  3. CAPABILITY: The client requests the server’s capabilities.
  4. STARTTLS (Optional): The client may upgrade to TLS encryption.
  5. LOGIN: The client sends the username and password.
  6. Authentication: The server authenticates the user.
  7. SELECT: The client selects a mailbox (e.g., INBOX).
  8. FETCH: The client retrieves message data (e.g., headers, body).
  9. UID FETCH: The client retrieves message data by UID (Unique ID).
  10. STORE: The client modifies message flags (e.g., mark as read, delete).
  11. EXPUNGE: The client permanently deletes messages marked for deletion.
  12. CLOSE: The client closes the selected mailbox.
  13. LOGOUT: The client closes the connection.
+-------+     143/993     +-----------+
|  MUA  |-------------------|   IMAP    |
+-------+     IMAP          +-----------+
     |                       |
     | CAPABILITY           |
     |--------------------->|
     |                       |
     |<---------------------| * CAPABILITY IMAP4rev1 ...
     |                       |
     | STARTTLS (Optional)  |
     |--------------------->|
     |                       |
     |<---------------------| OK Begin TLS negotiation
     |                       |
     (TLS Negotiation)      |
     |                       |
     | LOGIN <username> <password> |
     |--------------------->|
     |                       |
     |<---------------------| OK Login successful
     |                       |
     | SELECT INBOX         |
     |--------------------->|
     |                       |
     |<---------------------| * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
     |                       | * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted.
     |                       | * <num_messages> EXISTS
     |                       | * <num_recent> RECENT
     |                       | OK [READ-WRITE] Select completed.
     |                       |
     | FETCH 1 BODY[TEXT]   |
     |--------------------->|
     |                       |
     |<---------------------| * 1 FETCH (BODY[TEXT] {<size>}\r\n<message_body>\r\n)
     |                       | OK FETCH completed.
     |                       |
     | STORE 1 +FLAGS (\Deleted) |
     |--------------------->|
     |                       |
     |<---------------------| OK STORE completed.
     |                       |
     | EXPUNGE              |
     |--------------------->|
     |                       |
     |<---------------------| OK EXPUNGE completed.
     |                       |
     | LOGOUT               |
     |--------------------->|
     |                       |
     |<---------------------| * BYE IMAP4rev1 Server logging out
     |                       | OK LOGOUT completed.
     |                       |
+-------+                   +-----------+

SMTP

Section titled “SMTP”

Example SMTP Conversation (using telnet):

telnet example.com 25
Trying 93.184.216.34...
Connected to example.com.
Escape character is '^]'.
220 example.com ESMTP Postfix (Ubuntu)
EHLO client.example.com
250-example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
STARTTLS
220 2.0.0 Ready to start TLS
(TLS negotiation happens here)
EHLO client.example.com
250-example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
AUTH LOGIN
334 VXNlcm5hbWU6
dXNlcm5hbWU=  (Base64 encoded username)
334 UGFzc3dvcmQ6
cGFzc3dvcmQ=  (Base64 encoded password)
235 2.7.0 Authentication successful
MAIL FROM: <sender@example.com>
250 2.1.0 Ok
RCPT TO: <recipient@example.com>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
From: sender@example.com
To: recipient@example.com
Subject: Test Email


This is a test email.


.
250 2.0.0 Ok: queued as ABCDEF1234
QUIT
221 2.0.0 Bye
Connection closed by foreign host.

SMTP Headers (Example):

From: sender@example.com
To: recipient@example.com
Subject: Test Email
Date: Tue, 20 Oct 2023 10:00:00 -0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8

POP3

Section titled “POP3”

Example POP3 Conversation (using telnet):

telnet example.com 110
Trying 93.184.216.34...
Connected to example.com.
Escape character is '^]'.
+OK POP3 server ready
USER testuser
+OK User accepted
PASS password
+OK Password accepted, mailbox has 2 messages (320 octets)
STAT
+OK 2 320
LIST
+OK 2 messages (320 octets)
1 160
2 160
.
RETR 1
+OK 160 octets
Received: from ...
From: ...
... (Email content)
.
DELE 1
+OK Message 1 marked for deletion
QUIT
+OK POP3 server signing off (2 message(s) left)
Connection closed by foreign host.

IMAP

Section titled “IMAP”

Example IMAP Conversation (using openssl s_client for SSL/TLS):

Terminal window
openssl s_client -connect example.com:993

(After SSL/TLS handshake)

* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
a001 LOGIN testuser password
a001 OK Logged in
a002 SELECT INBOX
* FLAGS (\Answered \Flagged \Deleted \Seen \Draft)
* OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted.
* 2 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1697827200] UIDs valid
a002 OK [READ-WRITE] Select completed (0.001 + 0.000 secs).
a003 FETCH 1 BODY[TEXT]
* 1 FETCH (BODY[TEXT] {100}
This is the body of the first email.
)
a003 OK Fetch completed (0.001 + 0.000 secs).
a004 LOGOUT
* BYE Logging out
a004 OK Logout completed (0.001 + 0.000 secs).

Important IMAP Commands:

  • CAPABILITY: Lists supported features.

  • LOGIN <username> <password>: Authenticates the user.

  • SELECT <mailbox>: Selects a mailbox (e.g., INBOX, Sent, Drafts).

  • LIST "" "*" : Lists all mailboxes.

  • FETCH <message_set> <data_item>: Retrieves message data. <message_set> can be a single number (e.g., 1), a range (e.g., 1:3), or * (all). <data_item> can be BODY[TEXT], BODY[HEADER], FLAGS, UID, etc.

  • UID FETCH <uid_set> <data_item>: Retrieves message data by UID.

  • STORE <message_set> +FLAGS <flags>: Adds flags to a message.

  • STORE <message_set> -FLAGS <flags>: Removes flags from a message.

  • EXPUNGE: Permanently deletes messages marked with the \Deleted flag.

  • CLOSE: Closes the currently selected mailbox.

  • LOGOUT: Closes the connection.

  • Sending an email using sendmail (Linux):

    Terminal window
    echo "Subject: Test Email" | sendmail recipient@example.com

  • Checking email using mail (Linux):

    Terminal window
    mail -v -s "Test Email" -a "From: sender@example.com" recipient@example.com < message.txt

    (Assumes message.txt contains the email body). The -v option enables verbose output, showing SMTP interactions. This often requires sendmail or a compatible MTA to be configured.

  • Email archiving: IMAP is used to keep a central copy of emails on the server for backup and compliance purposes.

  • Mobile email clients: IMAP allows multiple devices to access the same email account and keep the mailbox synchronized.

IssueCauseSolution
Cannot send email (SMTP)Incorrect SMTP server address, port, authentication credentials, or firewall blocking the connection.Verify server settings, check firewall rules, ensure correct username/password. Test with telnet or openssl s_client to the SMTP server.
Cannot receive email (POP3/IMAP)Incorrect POP3/IMAP server address, port, authentication credentials, or firewall blocking the connection.Verify server settings, check firewall rules, ensure correct username/password. Test with telnet or openssl s_client to the POP3/IMAP server.
SSL/TLS errorsIncorrect SSL/TLS settings, expired certificate, or unsupported encryption protocols.Verify SSL/TLS settings, ensure the server’s certificate is valid, and use compatible encryption protocols. Check the server’s SSL/TLS configuration.
Email is marked as spamSender’s IP address is blacklisted, email content triggers spam filters, or missing SPF/DKIM/DMARC records.Check sender’s IP reputation, review email content for spam triggers, and configure SPF, DKIM, and DMARC records for the domain.
Email bouncesRecipient’s mailbox is full, recipient’s server is unavailable, or recipient’s address is invalid.Check the bounce message for details, verify the recipient’s address, and contact the recipient’s email provider if necessary.
Authentication failureIncorrect username/password, authentication method not supported, or server is down.Verify username/password, check the server’s supported authentication methods, and ensure the server is running.
”Relay access denied” (SMTP)The SMTP server is not configured to allow relaying from the client’s IP address.Ensure the client’s IP address is authorized to relay email through the SMTP server. This often involves configuring authentication or adding the client’s IP to a trusted list on the server.
Connection Timed OutFirewall blocking the connection, network connectivity issues, or server is overloaded.Check firewall rules, verify network connectivity, and check the server’s status. Use traceroute or ping to verify network reachability to the mail server.

  • Postfix (Linux MTA) - Basic Configuration (/etc/postfix/main.cf):

    myhostname = mail.example.com
    mydomain = example.com
    myorigin = $mydomain
    inet_interfaces = all
    mydestination = $myhostname, localhost.$mydomain, localhost
    relayhost = [mail.your-isp.com]  ; Optional:  Relay through your ISP's mail server

  • Dovecot (Linux IMAP/POP3 Server) - Basic Configuration (/etc/dovecot/dovecot.conf):

    protocols = imap pop3 lmtp
    listen = *, ::
    mail_location = mbox:~/mail:INBOX=/var/mail/%u

  • Configuring Email Client (e.g., Thunderbird):

    • Incoming Server (IMAP/POP3):
      • Server Name: mail.example.com
      • Port: 143 (IMAP, STARTTLS) or 993 (IMAPS) or 110 (POP3, STARTTLS) or 995 (POP3S)
      • Connection security: STARTTLS (if available) or SSL/TLS
      • Authentication method: Normal password
    • Outgoing Server (SMTP):
      • Server Name: mail.example.com
      • Port: 587 (STARTTLS) or 465 (SMTPS)
      • Connection security: STARTTLS or SSL/TLS
      • Authentication method: Normal password
      • Username: Your full email address (e.g., user@example.com)

Q: What are the differences between SMTP, POP3, and IMAP?

  • A: SMTP is used for sending email. POP3 and IMAP are used for retrieving email. POP3 downloads emails and typically deletes them from the server, while IMAP keeps emails on the server and allows clients to manage them remotely. IMAP is generally preferred for modern email clients because it allows for synchronization across multiple devices.

Q: Explain the SMTP process of sending an email.

  • A: The client connects to the server, identifies itself with EHLO/HELO, authenticates (if required), specifies the sender (MAIL FROM) and recipient(s) (RCPT TO), sends the email data (DATA), and then closes the connection (QUIT).

Q: What is STARTTLS, and why is it important?

  • A: STARTTLS is a command used to upgrade an unencrypted connection to an encrypted TLS connection. It’s important because it allows for secure communication (protecting usernames, passwords, and email content) without requiring a separate port for SSL/TLS. This allows existing unencrypted email servers to be easily upgraded to use encryption.

Q: What are SPF, DKIM, and DMARC, and how do they help prevent email spoofing?

  • A:

    • SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email on behalf of a domain. The recipient’s mail server checks the sender’s IP address against the SPF record.
    • DKIM (DomainKeys Identified Mail): Adds a digital signature to outgoing emails, allowing the recipient’s mail server to verify the email’s authenticity and ensure it hasn’t been tampered with.
    • DMARC (Domain-based Message Authentication, Reporting & Conformance): Specifies how the recipient’s mail server should handle emails that fail SPF and DKIM checks. It also provides reporting mechanisms to the sender, allowing them to monitor and improve their email authentication practices.

    These technologies work together to prevent email spoofing by verifying the sender’s identity and ensuring the email’s integrity.

Q: What are some common SMTP error codes, and what do they mean?

  • A:
    • 220: Service ready.
    • 221: Closing transmission channel.
    • 235: Authentication successful.
    • 250: Requested mail action okay, completed.
    • 334: Username/Password request.
    • 354: Start mail input; end with ..
    • 500: Syntax error, command unrecognized.
    • 501: Syntax error in parameters or arguments.
    • 503: Bad sequence of commands.
    • 530: Authentication required.
    • 550: Requested action not taken: mailbox unavailable.
    • 554: Transaction failed.

Q: How would you troubleshoot a situation where users are unable to send email?

  • A:
    1. Verify SMTP server settings: Ensure the correct server address, port, and authentication credentials are configured in the email client.
    2. Check network connectivity: Verify that the client can reach the SMTP server by using ping or telnet.
    3. Check firewall rules: Ensure that the firewall is not blocking the connection to the SMTP server on port 25, 587, or 465.
    4. Check SMTP server logs: Examine the SMTP server logs for any error messages or authentication failures.
    5. Test with telnet or openssl s_client: Manually connect to the SMTP server using telnet or openssl s_client to test the connection and authentication process.
    6. Check for relaying issues: If the SMTP server requires authentication for relaying, ensure that the client is properly authenticated.
    7. Check for blacklisting: Verify that the sender’s IP address is not blacklisted.

Q: Explain the difference between mbox and Maildir formats.

  • A:

    • mbox: Stores all emails for a user in a single file. This can lead to locking issues and corruption if multiple processes try to access the file simultaneously.
    • Maildir: Stores each email as a separate file in a directory structure. This eliminates locking issues and is generally more robust. Maildir is the preferred format for modern email servers.

  • DNS (Domain Name System): Used to resolve domain names to IP addresses, enabling email clients and servers to locate each other. MX records are crucial for email routing.

  • Firewalls: Control network traffic and can block or allow email connections.

  • Spam Filtering: Techniques used to identify and block unwanted email.

  • Email Security: Measures taken to protect email from threats such as phishing, malware, and data breaches. This includes SPF, DKIM, DMARC, TLS/SSL, and anti-spam solutions.

  • Network Monitoring: Tools used to monitor email traffic and identify performance issues.

  • Email Archiving: Solutions for storing and retrieving email for compliance and legal purposes.

  • LDAP (Lightweight Directory Access Protocol): Used for user authentication and authorization in some email server environments.

This cheatsheet provides a solid foundation for understanding and working with email protocols. Remember to consult official documentation and online resources for more in-depth information.