What Is SMTP?

The client opens a connection and greets the server with EHLO, which answers with the list of extensions it supports. The client then issues MAIL to declare the return address, one RCPT for each recipient, and DATA to begin the message itself.

Everything before DATA is the envelope and everything after it is content. That split is why SPF authenticates the MAIL address rather than the From header, and why a receiver can refuse a recipient before a single byte of the message has been sent.

Port 25 is server to server. MX records carry no port, so relay between mail servers always uses 25, which is also why many networks and cloud providers block outbound 25 for anything other than a known mail host.

Submission, meaning a client or an application handing a message to its own provider, uses 587 with STARTTLS or 465 with implicit TLS. Implicit TLS means the handshake begins the moment the connection opens, and current guidance is for a submission service to offer both.

Every command gets a three-digit reply, and the first digit carries the verdict. A 2 means the command was accepted, a 4 means a temporary failure the sender should queue and retry, and a 5 means a permanent one. In an ordinary transaction the sender sees 250 after most commands and 354 after DATA, which is the invitation to send the message itself.

The gap between 4 and 5 is the one that costs money to get wrong. A 421 or 451 is how a receiver expresses greylisting or a rate limit, and the message is meant to be tried again later; a 550 is a refusal that will not change. A sender that treats a 4xx as final throws away mail that would have been delivered on the next attempt.

An optional capability the server advertises in its answer to EHLO. The original protocol had no way to negotiate features, so ESMTP added one: the client greets with EHLO instead of HELO, and the server replies with a list of what it supports. SIZE declares the largest message it will accept, PIPELINING lets the client send several commands without waiting for each reply, and AUTH offers authentication.

STARTTLS is the extension that matters most, because encryption is not part of the base protocol and only exists where the server offers it. A client that greets with HELO gets no list at all, which means no TLS and no authentication, so a sender still speaking plain HELO is sending in the clear whether it intended to or not.

SMTP itself is plain text, and TLS is added by the STARTTLS extension after the greeting. It is opportunistic by default, so when a receiving server does not offer STARTTLS most senders deliver the message unencrypted rather than fail.

That default is what MTA-STS exists to close. A published policy tells senders that TLS and a valid certificate are required for your mail hosts, so an attacker cannot force a downgrade by stripping the STARTTLS offer.