1. Introduction

Email is a foundational technology of the internet, enabling asynchronous communication between individuals and organizations. Behind every email sent or received is a complex system of protocols, authentication mechanisms, and network configurations that ensure secure and reliable delivery.

This guide provides a comprehensive technical overview of email systems, covering core email protocols, DNS configurations, authentication methods, and best practices for managing email services.

Prerequisite Knowledge

To fully grasp the concepts in this guide, readers should have a basic understanding of:

• Networking fundamentals, including IP addresses and ports.
• Common network protocols, such as TCP/IP.
• Domain Name System (DNS) concepts, including MX records and SPF/DMARC.

If these concepts are new to you, a brief review of networking basics will be helpful before diving into the details of email systems.

Table of Contents

1. Introduction
   • Prerequisite Knowledge
2. Core Email Protocols
   • SMTP (Simple Mail Transfer Protocol)
   • IMAP (Internet Message Access Protocol)
   • POP3 (Post Office Protocol v3)
3. DNS Records and Their Role in Email
   • MX (Mail Exchange) Records
   • SPF (Sender Policy Framework) Record
   • DKIM (DomainKeys Identified Mail) Record
   • DMARC (Domain-based Message Authentication, Reporting, and Conformance) Record
4. Types of Email Services
   • Transactional Email Services
   • Email Hosting Services
   • Email Forwarding Services
   • SMTP Relay Services
5. Email Security and Best Practices
   • Preventing Spoofing and Phishing
   • Email Encryption
   • Spam Protection
6. Operating an Email System
   • Setting Up a Custom Email Domain
   • Integrating Email with Applications
7. Conclusion

2. Core Email Protocols

2.1 SMTP (Simple Mail Transfer Protocol)

SMTP is the protocol responsible for sending emails between mail servers and clients.

• Port 25: Traditionally used for server-to-server email transmission (often blocked by ISPs to prevent spam).
• Port 465: Used for SMTP over SSL (deprecated in favor of STARTTLS).
• Port 587: Recommended for SMTP with STARTTLS encryption.
• Port 2525: Alternative SMTP port often used by cloud email providers.

2.2 IMAP (Internet Message Access Protocol)

IMAP allows users to access and manage emails stored on a remote mail server.

• Port 143: IMAP without encryption.
• Port 993: IMAP with SSL/TLS encryption.

2.3 POP3 (Post Office Protocol v3)

POP3 is used to download emails from the server to a local device.

• Port 110: POP3 without encryption.
• Port 995: POP3 with SSL/TLS encryption.

3. DNS Records and Their Role in Email

The Domain Name System (DNS) plays a crucial role in email delivery, authentication, and security. Email systems rely on specific DNS records to determine where to send emails, verify sender authenticity, and prevent fraudulent messages from reaching users. Configuring these records correctly helps improve email deliverability, mitigate spam, and enhance security.

This section explores four key DNS records used in email communication: MX (Mail Exchange), SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). Each serves a specific function in the email authentication ecosystem.

3.1 MX (Mail Exchange) Records

MX records specify which mail servers are responsible for receiving email on behalf of a domain. When an email is sent to an address under a particular domain (e.g., user@example.com), the recipient’s email provider checks the domain’s MX records to determine where to route the email.

How It Works

• MX records contain the hostname of mail servers that handle incoming email.
• Each record has a priority value, with lower numbers indicating higher priority.
• Email systems attempt to deliver messages to the server with the lowest priority first.

Example

example.com.  IN  MX  10 mail.example.com.
example.com.  IN  MX  20 backup.example.com.

This configuration directs email to mail.example.com first and uses backup.example.com as a fallback.

Where to Configure

• MX records are set in the domain’s DNS settings, usually through a domain registrar or hosting provider’s control panel.

3.2 SPF (Sender Policy Framework) Record

SPF helps prevent email spoofing by specifying which mail servers are authorized to send emails on behalf of a domain. It reduces spam by allowing email servers to verify whether an email claiming to come from a domain is sent from an approved source.

How It Works

• The SPF record is a TXT record in DNS.
• When an email server receives a message, it checks the SPF record to verify if the sending server is authorized.
• If the sender’s IP address is not listed, the email can be rejected or marked as spam.

Example

example.com.  IN  TXT  "v=spf1 include:mailgun.org include:_spf.google.com ~all"

• The include mechanism allows third-party services (e.g., Mailgun, Google) to send emails on behalf of example.com.
• The ~all at the end signifies a soft fail for unauthorized senders (emails may be accepted but flagged).

Where to Configure

• SPF records are added as TXT records in the domain’s DNS settings.
• Managed through a domain registrar, hosting provider, or DNS management service.

3.3 DKIM (DomainKeys Identified Mail) Record

DKIM helps ensure email integrity by adding a cryptographic signature to outgoing emails. It verifies that emails were not altered during transit and confirms the authenticity of the sender.

How It Works

• DKIM uses a public-private key pair.
• The sender’s mail server adds a digital signature to email headers.
• The recipient’s email provider retrieves the sender’s public key from DNS and verifies the signature.
• If verification fails, the email may be marked as suspicious.

Example

mailo._domainkey.example.com  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0..."

• v=DKIM1: Indicates the DKIM version.
• k=rsa: Specifies the encryption algorithm.
• p=MIGfMA0...: The public key used for email verification.

Where to Configure

• DKIM records are added as TXT records in the domain’s DNS settings.
• The private key is stored securely on the outgoing mail server.
• Email services like Google, Microsoft, and Mailgun provide DKIM setup options.

3.4 DMARC (Domain-based Message Authentication, Reporting, and Conformance) Record

DMARC builds on SPF and DKIM to enforce email authentication policies and provides reporting on unauthorized email use. It helps prevent phishing and spoofing attacks.

How It Works

• DMARC policies instruct email providers on handling emails that fail SPF and DKIM checks.
• It provides a reporting mechanism for monitoring email authentication activity.
• Policies include:
  • p=none: Monitor but take no action.
  • p=quarantine: Send failed emails to spam.
  • p=reject: Block failed emails completely.

Example

_dmarc.example.com  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

• p=quarantine: Sends suspicious emails to spam.
• rua=mailto:dmarc-reports@example.com: Email reports of authentication failures to an administrator.

Where to Configure

• DMARC records are added as TXT records in the domain’s DNS settings.
• Reporting addresses should be monitored for insights into spoofing attempts.

4. Types of Email Services

4.1 Transactional Email Services

Used for automated emails such as password resets, order confirmations, and notifications.

4.2 Email Hosting Services

Provide inboxes and full email services for personal or business use.

4.3 Email Forwarding Services

Allow users to forward incoming emails to another email account.

4.4 SMTP Relay Services

Provide SMTP servers for sending outbound emails with higher deliverability.

5. Email Security and Best Practices

5.1 Preventing Spoofing and Phishing

5.2 Email Encryption

5.3 Spam Protection

6. Operating an Email System

6.1 Setting Up a Custom Email Domain

6.2 Integrating Email with Applications

7. Conclusion

Understanding email protocols, DNS configurations, and security measures is essential for developers, IT admins, and businesses. Whether you're setting up a business email, automating transactional emails, or ensuring high email deliverability, mastering these concepts will enable you to operate efficiently in the technical email landscape.

For further reading, explore the official documentation of services like Mailgun, Resend, and Amazon SES, as well as IETF standards for SMTP (RFC 5321) and email authentication (RFC 7208 for SPF, RFC 6376 for DKIM, and RFC 7489 for DMARC).