How SMTP Works: Email Delivery, Spoofing, SPF, DKIM & DMARC (Animated)

SMTP moves email from the sender’s mail server to the recipient’s. It was built on trust: by itself, SMTP lets a sender claim any “From” address. That is the root of phishing and business email compromise, and why SPF, DKIM and DMARC exist.

1. Submit the email: from your mail app to your server

Your mail app logs in to your company’s mail server (port 587) and hands over the message.

1. SUBMIT (Sender → Company mail server): Authenticated submission: your server knows it’s really you.

Wireshark filter:

smtp

2. Server to server: the smtp conversation

Your server looks up the recipient domain’s MX record in DNS, connects to that server on port 25, and they exchange short text commands.

1. EHLO (Company mail server → Recipient mail server): The sending server introduces itself.
2. 250 (Recipient mail server → Company mail server): The receiver lists what it supports. STARTTLS lets them encrypt the rest.
3. MAIL FROM (Company mail server → Recipient mail server): The envelope sender, used for bounces and for the SPF check.
4. RCPT TO (Company mail server → Recipient mail server): Who the message is for.
5. DATA (Company mail server → Recipient mail server): The message itself. Note the From: header is just text inside the data, separate from the envelope sender.
6. 250 (Recipient mail server → Company mail server): Accepted.
7. DELIVER (Recipient mail server → Recipient): Raj’s mail app fetches it with IMAP.

Wireshark filter:

smtp.req.command

3. Email spoofing: attack: write any “from” you like

Nothing in basic SMTP checks the From header. An attacker connects straight to the recipient’s server and claims to be the CEO.

1. MAIL FROM (Attacker → Recipient mail server): The attacker’s own server claims a company address.
2. DATA (Attacker → Recipient mail server): A convincing “urgent payment” message.
3. DELIVER (Recipient mail server → Recipient): With no checks, it lands in the inbox looking genuine. This is how business email compromise starts.

Wireshark filter:

smtp.req.parameter contains "FROM"

4. Spf, dkim & dmarc: defence: the receiver verifies the sender

The company publishes three DNS records. Receiving servers check them for every message.

1. DATA (Attacker → Recipient mail server): SPF fails (wrong server), DKIM fails (no signature), and the DMARC policy says reject.
2. 550 (Recipient mail server → Attacker): The forgery never reaches the inbox.

Dns records to publish:

v=spf1 ip4:203.0.113.25 -all
v=DMARC1; p=reject; rua=mailto:dmarc@company.example

FAQ