SMTP the protocol that moves the mail

A real SMTP conversation

Here's the thing about SMTP that surprises people the first time they see it: you can read it. The whole conversation is plain ASCII commands and numeric reply codes. A simplified send looks roughly like this:

S: 220 mx.example.com ESMTP ready
C: EHLO sender.example.org
S: 250-mx.example.com Hello sender.example.org
S: 250-STARTTLS
S: 250 SIZE 52428800
C: STARTTLS
S: 220 Ready to start TLS
... TLS handshake ...
C: MAIL FROM:<[email protected]>
S: 250 OK
C: RCPT TO:<[email protected]>
S: 250 Accepted
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
C: From: Alice <[email protected]>
C: To: Bob <[email protected]>
C: Subject: Test
C:
C: Hello.
C: .
S: 250 Message queued
C: QUIT
S: 221 Bye

That's it. The client (a sending MTA or your app) opens a TCP connection, the server greets it (220), the client identifies itself (EHLO, the extended HELO), they negotiate TLS, then the client declares the envelope sender (MAIL FROM) and each recipient (RCPT TO), then sends the message body after DATA, terminating with a lone dot on its own line. The server queues it and confirms with 250. You can do this by hand with openssl s_client if you want to see it live.

Envelope vs message

Notice that MAIL FROM happens before the message body, and the From header inside the message can be different from it. That distinction matters: MAIL FROM is the envelope sender (also called the Return-Path) and it's what bounces go back to. The From header is what the recipient's mail client displays. They can and often do differ. SPF authenticates the envelope MAIL FROM, not the visible From, which is why DMARC alignment matters.

The three ports, demystified

Three ports come up in SMTP, and they're not interchangeable. Port 25 is server-to-server (MTA-to-MTA) and is the original SMTP port. Most consumer ISPs and shared hosts block outbound port 25 because spammers historically abused it. Port 587 is the submission port, defined for clients submitting mail to a server they're authenticated with, using STARTTLS to encrypt. Port 465 is the implicit-TLS submission port, the connection is encrypted from the start. For an app sending mail, use 587 or 465, never 25.

Store-and-forward means delivery is asynchronous

When the receiving server returns 250 ("Message queued"), that doesn't mean the recipient has the email yet. It means that server accepted it. SMTP is store-and-forward: each MTA in the chain queues and forwards, retries on transient failures, and eventually delivers (or bounces). Delivery is not synchronous, and the latency between "we accepted it" and "it landed in the inbox" can vary from seconds to minutes depending on the receiver. That's why a 250 isn't a guarantee, just a handoff.

Why SMTP is still here in 2026

SMTP is older than the web by nine years. There have been a dozen attempted replacements. None succeeded, because email's whole value is universal interoperability, and the cost of a flag-day migration across every mail server on earth is infinite. So SMTP gets layered on top of, instead of replaced. STARTTLS encrypted the conversation. SPF, DKIM, and DMARC bolted authentication on. ARC handles forwarding. MTA-STS forces TLS. The plain-text 1982 protocol still works underneath all of it.

SMTP, MTAs, ESPs, relays

Terms that get confused: SMTP relay is a server that accepts mail from one source and forwards it onward via SMTP. MTA (Mail Transfer Agent) is the server software that speaks SMTP — Postfix, Exim, Sendmail. ESP (Email Service Provider) is the managed product wrapped around all of it. SMTP is the protocol; the others are pieces of infrastructure that use it.

How sendmsg.io fits

You can send through sendmsg.io over SMTP (ports 587/465 with auth) or over the REST API. Same sending engine underneath. SMTP is the lower-friction path when you already have a mail library in your app; the API is cleaner when you want webhooks and structured event data. The reputation engine watches every send regardless of which path you came in through.

Want to see where your sending stands today? The free deliverability check audits your SPF, DKIM, DMARC, and MX in seconds.