What is an MTA?
A Mail Transfer Agent (MTA) is the part of an email system that moves messages from one mail server to the next. When you send a message to someone at another domain, your organization's MTA looks up where that domain receives mail and hands the message to the recipient's MTA over SMTP (Simple Mail Transfer Protocol). Common MTAs include Postfix, Sendmail, Exim and Microsoft Exchange Server, which also stores mailboxes.
How an MTA delivers a message
- The sender's email client (the MUA) submits the message to its mail server, normally on port 587 with a login and STARTTLS encryption.
- The sender's MTA reads the recipient's domain from the address and queries DNS for that domain's MX (mail exchanger) records. The record with the lowest preference number is tried first.
- It connects to the recipient's MTA on TCP port 25 and transfers the message with SMTP. A message can pass through more than one MTA, such as a spam gateway, on the way.
- The receiving side hands the message to the MDA (Mail Delivery Agent), which stores it in the user's mailbox.
- The recipient's client retrieves it with IMAP or POP3.
If the destination server can't be reached, the MTA queues the message and keeps retrying for a while. If delivery still fails, it sends a bounce (a non-delivery report) back to the sender. Strictly, the service that accepts mail from clients on port 587 is called a mail submission agent, but it is usually part of the same server software.
MUA vs. MTA vs. MDA
| Component | Job | Examples |
|---|---|---|
| MUA (Mail User Agent) | The email client people use to write, send and read mail | Outlook, Apple Mail, Thunderbird, webmail |
| MTA (Mail Transfer Agent) | Routes and relays mail between servers over SMTP | Postfix, Sendmail, Exim, Exchange Server |
| MDA (Mail Delivery Agent) | Stores incoming mail in the right mailbox | Procmail, Dovecot's delivery agent |
Securing an MTA
- No open relay. An MTA should relay mail only for its own users and networks. An open relay that forwards mail for anyone is quickly abused by spammers and ends up on blocklists.
- Use TLS. STARTTLS upgrades SMTP connections to encrypted ones, from clients and between servers.
- Publish SPF, DKIM and DMARC. These DNS TXT records help receiving MTAs tell your real mail from forged mail.
For the CompTIA A+ exam
Core 1 (220-1201) objective 2.3 lists mail servers as a server role, objective 2.1 covers SMTP on port 25 along with POP3 (110) and IMAP (143), and objective 2.4 covers MX records and the DKIM, SPF and DMARC spam controls. MTA isn't on the Core 1 acronym list, but the idea behind it is tested: SMTP sends and relays mail between servers, while IMAP and POP3 are how clients retrieve it. MTA was also the name of a retired Microsoft certification, which is unrelated.