Why It Matters
SMTP is the backbone of email. Without it, no email goes anywhere. Understanding how it works helps you troubleshoot delivery failures, configure mail servers, and make informed decisions about your sending infrastructure. When someone says "our SMTP server is down," they mean outbound email has stopped entirely.
How It Works
Here's what happens when you hit "send":
- Your email client connects to an SMTP server (usually on port 587 for submission or 465 for implicit TLS).
- The SMTP server looks up the recipient's domain using DNS to find the MX (Mail Exchange) records.
- Your server opens a connection to the recipient's mail server and delivers the message using a series of commands: HELO, MAIL FROM, RCPT TO, DATA.
- The receiving server either accepts the message, rejects it, or temporarily defers it (causing a soft bounce).
The protocol itself is surprisingly simple and text-based. You can literally connect to an SMTP server with a terminal and type commands manually — it's a good way to learn how it works under the hood.
Key Components
SMTP Ports
Port 25 is the original SMTP port, used for server-to-server relay. Most ISPs block outbound port 25 to prevent spam. Port 587 is the standard for email submission (your client to your server) with STARTTLS encryption. Port 465 is used for SMTP over implicit SSL/TLS.
SMTP Authentication
Modern SMTP requires authentication before you can send. You provide a username and password (or an API key) so the server knows you're authorized. Without auth, any random spammer could relay mail through your server — which is called an open relay and will get you blacklisted within hours.
SMTP Response Codes
Every SMTP exchange produces response codes. The ones you'll see most often:
- 250 — Success. The server accepted your message.
- 421 — Service temporarily unavailable. Try again later.
- 450 — Mailbox temporarily unavailable (greylisting, rate limit).
- 550 — Mailbox doesn't exist. This is a hard bounce.
- 554 — Transaction failed, often due to spam filtering or policy rejection.
Common Mistakes
- Running an open relay — if your SMTP server doesn't require authentication, spammers will find it and abuse it within days.
- Not using TLS encryption — sending credentials or messages in plaintext is a security risk. Always require STARTTLS or implicit TLS.
- Ignoring bounce codes — each code tells you exactly what went wrong. A 550 is very different from a 421, and they need different responses.
- Hardcoding SMTP credentials in application code — use environment variables or a secrets manager instead.
Quick Tips
- Use port 587 with STARTTLS for sending from applications — it's the modern standard.
- Test your SMTP configuration with a tool like
swaks(Swiss Army Knife for SMTP) before going live. - Set up proper SPF, DKIM, and DMARC records for any domain you send from via SMTP.
- Monitor your SMTP logs for repeated 4xx errors — they often indicate throttling or reputation issues at the receiving end.