SMTP

The Simple Mail Transfer Protocol (SMTP) is the Internet standard for electronic mail transmission, currently specified in RFC 5321 (October 2008, which obsoletes RFC 821, RFC 974, RFC 1869, and RFC 2821). It is a text-based, client–server protocol that runs over a reliable ordered data stream — in practice, TCP port 25 (relay), with message submission typically on port 587 (RFC 4409) and the deprecated implicit-TLS variant on port 465. The companion message-format standard is RFC 5322.

SMTP transmits commands, replies, and message content in cleartext unless upgraded with the STARTTLS extension (RFC 3207) or wrapped in TLS.

Minimal manual transaction

A raw SMTP session — useful for testing open relays, enumerating users, or spoofing mail during an assessment — looks like this:

HELO somehostname
MAIL FROM:fromaddress@host1.tld
RCPT TO:toaddress@host2.tld
DATA
To: "To Address" <toaddress@host2.tld>
From: "From Address" <fromaddress@host1.tld>
Subject: An Email
This is content.
 
Here is another line.
.
QUIT

Key properties:

• Commands are not case-sensitive (though mailbox local-parts may be).
• The message body ends with a single . on its own line (<CRLF>.<CRLF>).
• The envelope (MAIL FROM / RCPT TO) and the header (From: / To: in the DATA block) are independent — they are not required to match. This gap is what makes naive email spoofing possible; MAIL FROM (the reverse-path) is where bounce messages go, while From: is what the recipient’s MUA displays. Omitting the envelope commands entirely may cause the message to be rejected.
• Modern implementations should prefer EHLO (extended hello, RFC 1869) over HELO; servers must support EHLO and clients should use it first, falling back to HELO for legacy interop.

Reply codes

Replies are three-digit codes; the first digit is the severity:

Code	Meaning
2xx	Success (e.g. 250 OK)
3xx	Intermediate (e.g. 354 Start mail input after DATA)
4xx	Transient failure (retry later, e.g. greylisting 450)
5xx	Permanent failure (e.g. 550 Mailbox unavailable)

Security relevance

• Open relay abuse — A server that relays mail for arbitrary sender/recipient pairs can be abused for spam and spoofing; testing for this is a standard external-assessment step.
• User enumeration — VRFY (verify address) and EXPN (expand mailing list) historically disclosed valid mailboxes; RFC 5321 §7.3 explicitly flags them as security-sensitive, and most servers now disable or gut them.
• Spoofing defenses — SPF, DKIM, and DMARC exist precisely because SMTP itself authenticates nothing about the envelope or header sender.
• Cleartext credentials — AUTH over unencrypted SMTP exposes credentials to sniffing, same as ftp; use STARTTLS or SMTPS.

Related: imap (online mail access), pop3 (offline mail retrieval), pull-ssl-certificates-external-server (STARTTLS certificate retrieval), ntlm-relay-attacks (cross-protocol relay abuse).

Sources

• RFC 5321 — Simple Mail Transfer Protocol
• Simple Mail Transfer Protocol — Wikipedia

See also

• imap
• pop3
• ftp
• pull-ssl-certificates-external-server
• ntlm-relay-attacks