~/knowledge-email

The Mail Pipeline

CPTS Notes2 min read
CPTS Notes
  1. Start Here
  2. General Framework
  3. Enumeration
  4. Enumeration with Nmap
  5. Services
  6. FTP
  7. SMB
  8. NFS
  9. DNS
  10. SMTP
  11. IMAP
  12. POP3
  13. Reference
  14. Port References
  15. Linux Commands Cheatsheet
  16. DNS Resolution
  17. The Mail Pipeline
  18. SMB & NetBIOS
On this page
  1. The pipeline
  2. Send versus retrieve
  3. STARTTLS and ESMTP
  4. Anti-spoofing: SPF, DKIM, DMARC

Background for the SMTP, IMAP, and POP3 cheatsheets. How mail moves, so the attacks make sense.

The pipeline

A message passes through four agents before it lands in a mailbox:

  1. MUA (Mail User Agent): the client that writes the mail.
  2. MSA (Mail Submission Agent): accepts authenticated submission, usually on 587.
  3. MTA (Mail Transfer Agent): routes and relays the mail between servers on 25.
  4. MDA (Mail Delivery Agent): drops it into the recipient’s mailbox.

The recipient then reads the mailbox over IMAP or POP3.

Send versus retrieve

SMTP only sends and relays. It never retrieves. Reading mail is IMAP or POP3:

Protocol Plaintext TLS Role
SMTP 25, 587 465 Send and relay
POP3 110 995 Retrieve, download and delete
IMAP 143 993 Retrieve, keep on the server with folders

STARTTLS and ESMTP

Plain SMTP, IMAP, and POP3 are cleartext, so credentials and mail cross the wire in the open. ESMTP (the extended SMTP everyone runs now) adds STARTTLS, which upgrades a plaintext connection to TLS after the greeting. AUTH then carries credentials safely. The implicit-TLS ports (465, 993, 995) wrap the whole session in TLS from the first byte instead.

Anti-spoofing: SPF, DKIM, DMARC

SMTP never verifies the sender, so anyone can set any MAIL FROM. Three DNS-based checks let a receiver tell a forged message from a real one:

  • SPF: a DNS TXT record listing which servers may send for the domain.
  • DKIM: a signature header the receiver checks against a public key in DNS.
  • DMARC: a DNS policy for what to do when SPF or DKIM fails, and where to send reports.

When these are missing or weak, a receiver cannot tell a spoofed sender from a real one. That is why an open relay and sender spoofing work.