A mail server is a system that sends, receives, stores, and routes email messages across networks. Mail servers act as digital post offices, handling the transmission of messages between users whether they're on the same network or across the globe. Organizations run their own mail servers for internal communication and security control, while many businesses now rely on cloud-hosted email services like Microsoft 365 or Google Workspace.
A complete email infrastructure typically involves multiple server roles working together: sending outbound mail, receiving inbound mail, and providing mailbox access to end users.
Email Protocols
Email relies on several protocols, each serving a specific function in the message lifecycle.
Protocol Comparison
SMTP (Simple Mail Transfer Protocol) handles sending and relaying mail. Your email client uses SMTP to submit outgoing messages, and mail servers use it to relay messages to each other. Port 25 is the traditional server-to-server relay port, while port 587 is the standard client submission port with STARTTLS encryption (port 465 for implicit SSL/TLS). SMTP only sends—it never retrieves mail.
POP3 (Post Office Protocol version 3) retrieves mail by downloading messages to a single device, typically deleting them from the server afterward (unless "leave a copy on server" is enabled). It uses port 110, or port 995 for the SSL/TLS-encrypted version (POP3S). POP3 suits single-device users but provides no synchronization across devices.
IMAP (Internet Message Access Protocol) keeps messages on the server and synchronizes mailbox state—read status, folders, deletions—across every connected device. It uses port 143, or port 993 for the encrypted version (IMAPS). IMAP is the standard choice for users who check mail from multiple devices.
Protocol Summary Table
| Protocol | Role | Port | Secure Port | Mailbox Behavior |
|---|---|---|---|---|
| SMTP | Sending and server-to-server relay | 25 (relay), 587 (submission) | 465 (SSL/TLS), 587 (STARTTLS) | Outbound only; does not store or retrieve mail |
| POP3 | Retrieving mail to one device | 110 | 995 (POP3S) | Downloads messages, usually deletes them from the server |
| IMAP | Retrieving and syncing mail | 143 | 993 (IMAPS) | Messages stay on the server; state syncs across all devices |
Mail Server Components
Enterprise mail systems consist of several components working together.
MTA (Mail Transfer Agent)
The MTA routes messages between servers using SMTP. When you send an email to someone at another domain, your MTA looks up the recipient's mail server and delivers the message. Popular MTAs include Microsoft Exchange, Postfix, and Sendmail.
MDA (Mail Delivery Agent)
The MDA receives mail from the MTA and places it in the correct user mailbox. It handles local delivery and mailbox storage.
MUA (Mail User Agent)
The MUA is the email client that users interact with—applications like Microsoft Outlook, Mozilla Thunderbird, Apple Mail, or webmail interfaces. The MUA retrieves mail via POP3 or IMAP and sends mail via SMTP.
Message Flow Example
- User composes email in Outlook (MUA)
- Outlook sends message via SMTP to organization's mail server
- The MTA queries DNS for the recipient's MX record
- MTA relays message to recipient's mail server via SMTP
- Recipient's MDA delivers message to the mailbox
- Recipient's MUA retrieves message via IMAP
DNS Records for Email
Mail servers rely on specific DNS records to function properly.
MX Records
MX (Mail Exchange) records specify which servers handle email for a domain. Each MX record includes a priority value; lower numbers indicate higher priority. If the primary server is unavailable, mail routes to the next priority server.
Example MX records for example.com:
Mail servers attempt delivery to mail1 first. If it's unreachable, they try mail2.
Other Important Records
A/AAAA Records: Map mail server hostnames to IP addresses
PTR Records: Reverse DNS lookup; many mail servers reject messages from IPs without valid PTR records
SPF Records: Specify which servers are authorized to send mail for the domain
DKIM Records: Contain public keys for verifying email signatures
DMARC Records: Define policies for handling messages that fail SPF or DKIM checks
Email Security
Email is a primary target for attacks. Understanding security measures helps protect users and organizations.
Authentication Protocols
SPF (Sender Policy Framework) publishes a DNS TXT record listing authorized sending servers. Receiving servers check if incoming mail comes from an approved source.
DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing messages.