Email Protocols: SMTP, POP3, IMAP – Workflows, Security & Configurations

TAKEAWAYS:

• SMTP uses port 25/587 for store-and-forward email delivery via handshake phases (greeting, MAIL FROM, RCPT TO, DATA, QUIT).
• POP3 (port 110) downloads emails once and deletes them from the server, while IMAP (port 143) keeps them synchronized across devices.
• Email headers contain envelope vs. message headers, with critical fields like From, To, Subject, and MIME-Version for attachments.
• Security threats include spam, phishing, and MITM attacks, mitigated by TLS/SSL, SPF, DKIM, and DMARC.
• Linux servers configure email services using Postfix (SMTP) + Dovecot (POP3/IMAP) with /etc/postfix/main.cf and /etc/dovecot/dovecot.conf.

---

1. Email Services Overview: Protocols and Roles

Email systems rely on three core protocols:

• SMTP (Simple Mail Transfer Protocol): Sends emails between servers (port 25 or 587 for submission).
• POP3 (Post Office Protocol v3): Downloads emails once to a client (port 110).
• IMAP (Internet Message Access Protocol): Syncs emails across devices (port 143 or 993 for SSL).

---

2. SMTP: How Emails Travel Across the Internet

SMTP operates in four phases (with TLS encryption for security):

1. Greeting: Client → Server (HELO example.com)
2. Mail Sender: MAIL FROM: <sender@example.com>
3. Recipient: RCPT TO: <recipient@domain.com>
4. Data Transfer: DATA → Email body → QUIT

SMTP Message Format

Emails consist of:

• Envelope Headers (hidden, used by servers):
  • Return-Path:
  • Received: from ... by ...
• Message Headers (visible to users):
  • From: sender@example.com
  • To: recipient@example.com
  • Subject: Hello!
  • MIME-Version: 1.0 (for attachments)

Worked Example: Sending an Email via SMTP Scenario: User sends an email from alice@tu.edu.np to bob@pu.edu.np using eSewa’s SMTP server.

1. Alice’s device connects to smtp.esewa.com.np:587.
2. SMTP handshake:

   Client: EHLO alice.com
   Server: 250-hello
   Client: MAIL FROM: <alice@tu.edu.np>
   Server: 250 OK
   Client: RCPT TO: <bob@pu.edu.np>
   Server: 250 OK
   Client: DATA
   Server: 354 Start mail input
   Client: Subject: Payment Confirmation
   Client: From: alice@tu.edu.np
   Client: To: bob@pu.edu.np
   Client: .
   Server: 250 OK
   Client: QUIT
   

---

3. POP3 vs. IMAP: Retrieving Emails

POP3 Workflow

1. Client connects to server (USER alice, PASS secret).
2. Server lists emails (LIST).
3. Client downloads (RETR 1).
4. Server deletes (unless configured to keep).

IMAP Workflow

1. Client connects (LOGIN alice secret).
2. Server lists folders (LIST "" "*").
3. Client selects folder (SELECT INBOX).
4. Server syncs changes (e.g., flags, deletions).

---

4. Security in Email Services

Threats

• Spam: Unsolicited emails (e.g., Daraz promotions).
• Phishing: Fake emails (e.g., Nepal Rastra Bank scams).
• MITM (Man-in-the-Middle): Eavesdropping on unencrypted SMTP.

Mitigations

---

5. Configuring Email Services on Linux

Installing Postfix (SMTP) and Dovecot (POP3/IMAP)

1. Install packages (Ubuntu/Debian):

   sudo apt update
   sudo apt install postfix dovecot-core
   

2. Configure Postfix (/etc/postfix/main.cf):

   myhostname = mail.example.com
   mydomain = example.com
   myorigin = $mydomain
   inet_interfaces = all
   

3. Configure Dovecot (/etc/dovecot/dovecot.conf):

   protocols = imap pop3
   ssl = required
   

4. Restart services:

   sudo systemctl restart postfix dovecot
   

---

6. Real-World Applications

In the Real World

• eSewa: Uses SMTP with TLS to send payment confirmations securely.
• Khalti: Relies on DKIM and DMARC to prevent spoofed transaction emails.
• Ncell: Older systems used POP3 for basic email retrieval; newer ones use IMAP for sync.
• Nepal Stock Exchange (NEPSE): Employs SPF records to authenticate shareholder emails.

Worked Example: NTC’s Email Relay Nepal Telecom Company (NTC) uses an SMTP relay to route internal emails between departments.

1. Internal Email Flow:
   • user1@ntc.gov.np → smtp.ntc.gov.np:25 → Relay server → user2@ntc.gov.np.
2. Security:
   • SPF: Ensures only NTC’s servers send emails.
   • TLS: Encrypts emails in transit.

---

Exam Tip

1. SMTP Questions:
   • Memorize the 4-phase handshake (HELO, MAIL FROM, RCPT TO, DATA).
   • Know ports: 25 (SMTP), 587 (submission), 465 (SMTPS).
2. POP3 vs. IMAP:
   • POP3 = download-and-delete; IMAP = sync.
   • Expect comparison tables in short-answer questions.
3. Security:
   • SPF/DKIM/DMARC are often asked together. Draw their flowchart.
4. Linux Config:
   • Be ready to edit /etc/postfix/main.cf or /etc/dovecot/dovecot.conf in practicals.
5. Real-World Scenarios:
   • Relate eSewa/Khalti emails to TLS/SPF in descriptive questions.

---

Key Formula to Remember:

SMTP Ports:
- 25 (SMTP), 587 (Submission), 465 (SMTPS)
POP3/IMAP Ports:
- 110 (POP3), 143 (IMAP), 993 (IMAPS), 995 (POP3S)