What are email protocols and why do they matter?

These protocols make sure a message gets from the sender to the recipient. They handle everything from how the email is sent and received to how it's formatted and verified as legitimate along the way.

Whether you want to better understand how email works, or you need specific advice around which protocol to use for a particular task, this article will help. We’ll explain what email protocols are and then walk through each one and why it matters.

An email protocol is a set of rules that defines how email messages are formatted, transmitted, and retrieved between servers and clients. 

Think of email protocols as a shared language that helps different systems communicate. It’s what makes email work across different networks, providers, and devices, and it’s why an email sent from Gmail can be received by an inbox from Outlook, Yahoo or any other service. The graphic below shows how it works. 

Here are the main protocols that handle different parts of the email’s journey:

• Sending (SMTP): Simple Mail Transfer Protocol moves a message from the sender's email client to their outgoing mail server, then relays it to the recipient's mail server

• Receiving (IMAP and POP3): Internet Message Access Protocol and Post Office Protocol let a recipient's email client connect to their mail server and retrieve messages. IMAP syncs messages across devices, and POP3 downloads them to a single device

• Formatting (MIME): Multipurpose Internet Mail Extensions define what a message can contain beyond plain text, such as attachments, HTML, and images, so email isn't limited to unformatted words

• Authentication (SPF, DKIM, and DMARC): Sender Policy Framework; DomainKeys Identified Mail; and Domain-based Message Authentication, Reporting, and Conformance verify a message came from who it claims to be from, and that it hasn't been tampered with in transit, protecting you from email spoofing and fraud

• Encryption protocols (TLS, STARTTLS, S/MIME, PGP/SGP): Encrypt the message and/or the connection it travels over, so contents stay unreadable to anyone who intercepts them in transit.

Next, we’ll have a look at each of these email protocols in more detail.

Simple Mail Transfer Protocol (SMTP) is the standard used to send email from a client to a server, and to relay it between servers until it reaches its destination.

When someone hits "send," their email client connects to an outgoing mail server over SMTP and hands off the message. From there, that server takes responsibility for routing it—often through a few intermediary servers—until it reaches the recipient's mail server.

Behind the scenes, SMTP servers talk to each other using commands. For example:

• HELO/EHLO announce the client to the server using a domain name

• MAIL FROM specifies the email address of the sender

• RCPT TO specifies the email address of the recipient or recipients 

If something goes wrong, such as an invalid address or a rejected connection, SMTP returns an error code that points to where things broke down.

If you're building or troubleshooting transactional email infrastructure, SMTP is the layer you'll bump into most. An SMTP relay service like MailerSend can help you get set up fast.

SMTP ports explained

SMTP messages travel over network ports. The one you use affects security and functionality. 

Here are the four SMTP ports you’re likely to come across:

• Port 25: The original SMTP port, used for server-to-server mail relay. Most residential ISPs block outbound traffic on port 25 to cut down on spam from compromised machines, so it's rarely used for direct client-to-server sending anymore

• Port 587: The standard port for mail submission from a client to its outgoing server. It's typically paired with STARTTLS, a command that upgrades a plain-text connection to an encrypted one partway through the session. This is the port most modern email clients and applications use to send mail

• Port 465: An older port for SMTP over SSL, where encryption is applied from the moment the connection opens rather than upgraded partway through. It fell out of favor for a while in favor of 587 with STARTTLS, but it's seen renewed use since it skips a downgrade attack risk that STARTTLS is exposed to

• Port 2525: An unofficial port not recognized by IANA or the IETF, but widely supported by ESPs and hosting providers as a fallback when port 587 is blocked. It functions like 587 (including TLS support), making it a useful backup port

Most email clients and marketing automation services have configured the SMTP protocol and encrypted ports so you won’t have to do anything. 

But if you want to set up SMTP yourself, you should fill in all the SMTP credentials (sender and server name) in the mail client settings and choose a port.

IMAP and POP3 are email protocols that let an email client retrieve messages from a mail server. While they perform the same job, they take very different approaches.

Internet Message Access Protocol (IMAP) keeps messages on the mail server and syncs them across every device that accesses the account. It means if you read a message on your phone, it shows as read on your laptop too.

IMAP4 offers 2 ports:

1. Port 143: The original port (unencrypted unless upgraded via STARTTLS)

2. Port 993: Known as IMAPS, it’s a secure port preferred by email clients

Overall, IMAP4 has become an efficient solution for teams that handle multiple email inboxes and require synchronization between several devices, which is pretty common these days.

Post Office Protocol (POP3) works differently: it downloads messages to a single device and removes them from the server afterward. This saves server space and means that you could check your emails even when you didn’t have an email connection. 

That made a lot of sense back when people only checked email from one computer and internet connections were unreliable, though it's fallen out of favor as multi-device use became the norm.

POP3 also has 2 ports:

• Port 110: A default port

• Port 995: A secured and encrypted option

As you might guess, the latter one is preferable due to its extra security. 

MIME protocol is a standard that allows emails to carry attachments, embedded images, HTML formatting, and multiple content types.

Before MIME, you could only send basic ASCII text in an email: no images, formatted layouts, or attachments.

MIME fixes this by adding headers that specify the email’s content type and encoding, telling the receiving client how to interpret each part of a message. This could be HTML, an embedded image, or a PDF attachment. 

MIME also makes it possible to send two versions of a message at once in different formats. A common reason to do this is when you send a plain-text version of an email alongside the HTML version, in case the client doesn't support HTML.

The good news is that while the MIME protocol works in the background to help your emails look great, you’re unlikely to ever have to deal with it directly. 

SPF, DKIM and DMARC are authentication protocols built to fight spoofing and phishing. 

• Sender Policy Framework (SPF) lets a domain owner publish a list of mail servers allowed to send email on their behalf. When a receiving server gets a message, it checks the sender's domain against that list. If the sending server isn't on it, the message looks suspicious.

• DomainKeys Identified Mail (DKIM) adds a digital signature to outgoing messages, generated with a private key the sending domain holds. The receiving server checks that signature against a public key in the domain's DNS records, confirming the message wasn't altered and really came from that domain.

• Domain-based Message Authentication, Reporting, and Conformance (DMARC) tells receiving servers what to do when a message fails SPF or DKIM; either quarantine it, reject it, or let it through. It also gives domain owners visibility into failures through reporting

Mailbox providers like Gmail and Yahoo lean heavily on authentication status when deciding whether a message lands in the inbox or the spam folder. If you don’t set up SPF, DKIM, and DMARC, there’s a high chance that your messages will head straight to spam. 

What’s more, most email marketing services, including MailerLite, require you to set up SPF and DKIM before starting sending. 

Proper authentication also helps keep your brand safe by making it much harder for bad actors to spoof your domain.

Encryption protocols protect the contents of an email from being read by anyone other than the intended recipient, whether it's intercepted in transit or accessed while sitting on a server.

• Transport Layer Security (TLS): Encrypts the connection between mail servers as emails travel across the internet. Most modern email providers enforce TLS by default

• STARTTLS: A command that upgrades an existing unencrypted connection to a secure TLS connection. If the other side doesn't support it, the connection falls back to plain text, which is a potential vulnerability

• Secure/Multipurpose Internet Mail Extensions (S/MIME): Provides end-to-end encryption and digital signatures at the message level. It requires both sender and recipient to exchange digital certificates, which makes it more common in enterprise environments

• Pretty Good Privacy (PGP) / GNU Privacy Guard (GPG): Another method of end-to-end encryption and digital signing that offers strong privacy. Instead of certificates, PGP uses a web-of-trust model where users exchange public keys directly. It has seen limited mainstream adoption because it only works if the people you're emailing use it too, and key management adds real overhead for non-technical users

These protocols aren’t the only things keeping your messages safe. Many providers separately encrypt stored mail at the infrastructure level too. 

Email protocols keep messages moving

Email protocols keep messages moving reliably between servers, inboxes, and devices. The ones you need to know about depend on what task you are trying to achieve. 

If you're setting up business email, choose between IMAP vs. POP3; if you're configuring a domain for sending email campaigns, you’ll need to set up SPF, DKIM, and, ideally, DMARC; and if you're building out transactional email infrastructure, understanding SMTP and its ports is likely to help.