SMTP, POP3, IMAP Protocols (en)

Simple Explanation of How SMTP, POP3, and IMAP Protocols Work

Main Differences:

• SMTP: Used only for sending emails.
• POP3: Downloads emails to a local device and deletes them from the server (if configured that way).
• IMAP: Synchronizes emails between the server and various devices, allowing access from anywhere.

Simple Interaction Examples:

• Sending email: Using SMTP.
• Reading email: Using POP3 or IMAP.
• Retrieving email: Using IMAP (to download emails to a local device without deleting them from the server).

Note: The handshake examples above are a very simplified version. In practice, these protocols have many more complex commands and responses.

SMTP (Simple Mail Transfer Protocol)

• Function: Used for sending emails.
• How it works:

1. The email client (e.g., Outlook, Gmail) sends an email to the SMTP server.
2. The SMTP server checks the email, ensures the destination address is valid, and adds the necessary headers.
3. The SMTP server forwards the email to the destination server.
4. The destination server stores the email in the recipient's inbox.

• Example handshake:

Client: HELO mydomain.com  
Server: 250 mydomain.com, pleased to meet you  
Client: MAIL FROM:<[email address removed]>  
Server: 250 OK  
Client: RCPT TO:<[email address removed]>  
Server: 250 OK  
Client: DATA  
Server: 354 Go ahead  
Client: (email content)  
Client: .  
Server: 250 OK  

POP3 (Post Office Protocol version 3)

• Function: Used for downloading emails from the server to the client device.
• How it works:

1. The email client connects to the POP3 server.
2. The client downloads all unread emails or selected emails.
3. The client usually deletes emails from the server after downloading (unless configured to keep a copy).

• Example handshake:

Client: USER username  
Server: +OK Password required  
Client: PASS password  
Server: +OK user is authenticated  
Client: STAT  
Server: +OK 2 500  
Client: RETR 1  
Server: +OK 500 octets  
(Server sends the email content)  
Client: DELE 1  
Server: +OK message 1 deleted  
Client: QUIT  
Server: +OK POP3 server signing off  

IMAP (Internet Message Access Protocol)

• Function: Used for accessing emails from various devices. Emails remain stored on the server and can be accessed from anywhere.
• How it works:

1. The email client connects to the IMAP server.
2. The client can choose to download the entire email, just the headers, or only unread emails.
3. Changes made to emails (e.g., marked as read, moved to another folder) will be synchronized with the server.

• Example handshake:

Client: A001 CAPABILITY  
Server: * CAPABILITY IMAP4rev1 CHILDREN IDLE NAMES STARTTLS UIDPLUS  
Server: A001 OK CAPABILITY completed  
Client: A002 LOGIN username password  
Server: A002 OK Logged in  
Client: A003 SELECT INBOX  
Server: * 1 EXISTS  
Server: * 2 RECENT  
Server: * FLAGS (\Seen \Answered \Flagged \Deleted \Draft)  
Server: A003 OK [READ-WRITE] Selected  
Client: A004 FETCH 1:2 ALL  
Server: * 1 FETCH (FLAGS (\Seen) INTERNALDATE "14-Aug-2012 10:45:01 +0100" RFC822 {...})  
Server: * 2 FETCH (FLAGS (\Recent) INTERNALDATE "14-Aug-2012 10:46:01 +0100" RFC822 {...})  
Server: A004 OK FETCH completed  

Conclusion:

SMTP, POP3, and IMAP are complementary protocols in the email system. SMTP is responsible for sending, POP3 for downloading, and IMAP for synchronization and access from various devices.

Interesting Links

• Forensic: IT
• https://www.rfc-editor.org/info/rfc788