EMAIL PROTOCOLS & SECURITY

A Comprehensive Analysis

Email Protocols & Security Architecture

Course Overview

Topics Covered:

• SMTP (Simple Mail Transfer Protocol) - Email Transmission

• POP3 - Post Office Protocol Version 3

• IMAP - Internet Message Access Protocol

• Email Header Analysis - Structure & Components

• Email Spoofing - Attack Methods & Implications

• Phishing - Social Engineering via Email

• Security Measures & Defenses

Email Systems - Fundamentals

What is Email?

• Electronic mail system for sending and receiving messages over networks

Key Components:

• Mail User Agent (MUA): Client application (Outlook, Gmail)

• Mail Transfer Agent (MTA): Server for routing emails (Postfix, Exchange)

• Mail Delivery Agent (MDA): Delivers to recipient mailboxes

• Mail Access Protocols: POP3, IMAP for retrieving messages

SMTP - Simple Mail Transfer Protocol

Overview:

• Protocol for sending and relaying emails

• Operates on TCP Port 25 (standard), 587 (submission), 465 (SMTPS)

• Defined in RFC 5321

Key Characteristics:

• Push protocol - actively sends emails to servers

• Server-to-server communication

• Simple and straightforward text-based protocol

SMTP Architecture & Process

User MUA

(Outlook, Gmail)

Submit

Server

(Port 587)

Sender SMTP

Server

Recipient SMTP

Server

Recipient

Mailbox

SMTP Session Commands:

• EHLO/HELO - Initiate connection

• AUTH - Authenticate (if required)

• MAIL FROM - Specify sender

• RCPT TO - Specify recipient(s)

• DATA - Send message body

• QUIT - Close connection

SMTP - Advantages

✓ Simple & Standardized: Easy to implement and widely supported across all email providers

✓ Reliable Delivery: Ensures email reaches recipient servers with delivery notifications (NDN)

✓ Multi-recipient Support: Single message can be sent to multiple recipients efficiently

✓ Robust Error Handling: Built-in error codes and status messages for troubleshooting

✓ Authentication Support: SMTP AUTH enables secure credential verification

SMTP - Disadvantages & Limitations

✗ Security Vulnerabilities: Original protocol lacks encryption; susceptible to man-in-the-middle attacks

✗ Spam & Abuse: No authentication requirement in early versions enables spam and spoofing

✗ No Encryption by Default: Credentials and message content transmitted in plain text

✗ Open Relay Issues: Misconfigured SMTP servers can be exploited for spam distribution

✗ Limited Message Retrieval: SMTP only sends; cannot retrieve messages from server

SMTP - Applications & Use Cases

Enterprise Email Systems:

• Microsoft Exchange, IBM Notes, Google Workspace use SMTP for message routing

Transactional Email Services:

• SendGrid, Mailgun, AWS SES - send password resets, confirmations, notifications

Marketing Automation:

• HubSpot, Constant Contact use SMTP for bulk email campaigns

Application Notifications:

• Web services send automated alerts, receipts, order confirmations via SMTP

POP3 - Post Office Protocol Version 3

Overview:

• Protocol for retrieving emails from server to client

• Operates on TCP Port 110 (standard), 995 (POP3S with SSL/TLS)

• Defined in RFC 1939

Key Characteristics:

• Pull protocol - client downloads emails from server

• Simple authentication with username and password

• Stateful connection - maintains session state

• Default behavior: deletes emails from server after download

POP3 Working Model & Commands

POP3 Connection States:

• 1. Authorization State: Server waits for USER/PASS credentials

• 2. Transaction State: Client can retrieve messages, list, delete

• 3. Update State: Deletions are committed when QUIT command issued

Common POP3 Commands:

• USER - Specify username

• PASS - Specify password

• LIST - List all messages (size)

• RETR - Retrieve specific message

• DELE - Mark message for deletion

• QUIT - Commit deletions and close

POP3 - Advantages

✓ Simple & Lightweight: Minimal overhead, fast retrieval of messages

✓ Offline Access: Downloads emails locally; can read without connection

✓ Server Storage Savings: Automatic deletion frees up server space

✓ Wide Compatibility: Supported by virtually all email clients

✓ Fast Connection: Lower bandwidth usage due to simplicity

POP3 - Disadvantages & Limitations

✗ Single Device Limitation: Emails deleted after download; not accessible from other devices

✗ Poor Synchronization: No sync across multiple clients; lost emails on device failure

✗ Limited Search: Cannot efficiently search server-side; must download all messages first

✗ No Folder Support: Cannot manage folders/labels on server side

✗ Stateful Design: Connection state management adds complexity

IMAP - Internet Message Access Protocol

Overview:

• Advanced protocol for accessing emails on server

• Operates on TCP Port 143 (standard), 993 (IMAPS with SSL/TLS)

• Defined in RFC 3501

Key Characteristics:

• Client manipulates mailbox on server, not downloads locally

• Synchronization across devices - consistent state everywhere

• Rich feature set: multiple folders, flags, search, partial retrieval

• Emails remain on server until explicitly deleted

IMAP vs POP3 - Comparison

Feature

POP3

IMAP

Storage

Local

Server

Sync

Single device

Multi-device

Folders

Client-side only

Server-side

Search

Limited

Full-text

Deletion

Auto-delete

Manual

Bandwidth

Low

Higher

Complexity

Simple

Complex

IMAP - Advantages

✓ Multi-Device Synchronization: Access and sync emails across all devices seamlessly

✓ Server-Side Management: Folders, flags, and status maintained on server

✓ Full-Text Search: Efficiently search messages on server without downloading

✓ Partial Retrieval: Download headers, attachments, or body separately

✓ Selective Sync: Choose what folders/messages to download locally

IMAP - Disadvantages & Limitations

✗ Complexity: More commands, more overhead, harder to implement

✗ Server Dependency: Requires active connection to server for operations

✗ Higher Bandwidth: Continuous syncing and full-text search consumes more data

✗ Server Storage: Emails accumulate on server consuming storage resources

✗ Performance Issues: Large mailboxes can be slow; server connections unstable

Email Header Analysis - Introduction

What is an Email Header?

Metadata attached to every email containing routing, sender, recipient, and content information. Defined in RFC 5322.

Header Structure:

• From: Sender's email address

• To: Primary recipient address

• Cc: Carbon copy recipients

• Bcc: Blind carbon copy (hidden from others)

• Subject: Email topic

• Date: Transmission timestamp

• Message-ID: Unique identifier

• Received: Routing path and server stamps

Email Header Fields - Detailed Analysis

From: Author of the message - CRITICAL for authentication

• Displays sender address; can be spoofed if not validated

Message-ID: Unique identifier format: <timestamp@hostname>

• Used to identify and track messages across systems

Received: Shows complete routing path with server names and IPs

• Multiple entries trace message journey; analyze for spoofing

Date: RFC 2822 timestamp (e.g., Wed, 23 Jul 2026 10:30:00 +0000)

• Check for timezone inconsistencies indicating spoofing

Header Analysis - Tools & Techniques

Viewing Email Headers:

• Gmail: Show original (three dots → Show original)

• Outlook: File → Info → Message → Actions → View message details

Analysis Tools:

• MXToolbox Header Analyzer - Online tool for header inspection

• Email Header Analyzer - Check routing, SPF, DKIM, DMARC records

What to Look For:

• Sender IP address discrepancies with claimed origin

• Missing or invalid authentication headers (SPF, DKIM, DMARC)

Email Spoofing - Definition & Attack Methods

Email Spoofing: Forging the sender's email address to appear legitimate. Attacker impersonates trusted entity to deceive recipients into opening attachments or clicking malicious links.

Why Email Spoofing Works:

• Original SMTP protocol had no built-in authentication mechanism

• SMTP accepts email from any source without verification

• Header fields (From, Reply-To) easily modifiable by client

• Many users don't examine headers to verify sender authenticity

• Legitimate-looking emails bypass initial suspicion

Email Spoofing - Attack Methods

Header Modification:

• Attacker changes From, Reply-To fields in email client

SMTP Injection:

• Exploit web forms to inject SMTP commands and forge emails

Domain Masquerading:

• Register similar domain (g00gle.com) to impersonate legitimate organization

Display Name Deception:

• Use well-known name but different actual email address

Compromised Server:

• Hack legitimate email server to send fraudulent emails

Phishing Attacks - Social Engineering via Email

Phishing: Fraudulent emails attempting to trick users into revealing sensitive information, downloading malware, or visiting fake websites. Combines spoofing with social engineering.

Phishing Attack Cycle:

• 1. Reconnaissance: Attacker researches target organization and employee details

• 2. Spoofing: Craft convincing email from trusted source (bank, IT dept, CEO)

• 3. Social Engineering: Use urgency, authority, fear to motivate action

• 4. Credential Theft: Direct to fake login page capturing passwords

• 5. Exploitation: Access stolen credentials, install malware, or steal data

Phishing - Attack Variants

Generic Phishing: Bulk emails targeting anyone who banks with institution

• Low success rate but easy to execute at scale

Spear Phishing: Targeted emails with researched personal details

• CEO Fraud: Impersonate executive to request wire transfers

Whaling: Target high-value individuals (executives, administrators)

Clone Phishing: Duplicate legitimate email and change action link

Vishing: Voice phishing using phone calls after email priming

Phishing Detection - Red Flags to Watch

🚩 Urgent Action Required: "Verify account immediately" or "Confirm within 24 hours"

🚩 Suspicious Links: Hover over link - URL doesn't match claimed sender domain

🚩 Generic Greeting: "Dear Customer" instead of personal name

🚩 Misspellings: Typos, grammar errors in official communication

🚩 Spoofed Headers: Sender address doesn't match display name or organization

Email Security - SPF (Sender Policy Framework)

What is SPF?

• Authentication protocol preventing email spoofing by verifying sender IP

• Published as DNS TXT record in sending domain

How SPF Works:

• Domain publishes list of authorized mail servers in DNS

• Receiving server checks sender IP against published list

• Pass/Fail/Softfail decisions made based on policy

SPF Limitations:

• Only validates origin server IP, not message content

• Ineffective against compromised authorized servers

Email Security - DKIM (DomainKeys Identified Mail)

What is DKIM?

• Digital signature verifying message authenticity and integrity

• Uses public/private key cryptography (RFC 6376)

How DKIM Works:

• Sender signs email headers/body with private key

• Public key published in DNS TXT record

• Receiver retrieves public key and verifies signature

DKIM Benefits:

• Prevents message tampering and header spoofing

• Establishes domain reputation and deliverability

Email Security - DMARC (Domain-based Message Auth, Reporting & Conformance)

What is DMARC?

• Policy framework combining SPF and DKIM for alignment

• Defines how to handle authentication failures

How DMARC Works:

• Checks if From domain aligns with SPF/DKIM

• Policy options: none (monitor), quarantine, reject

• Sends reports to admin on auth results

DMARC Policies:

• p=none: Accept all, report failures

• p=quarantine: Move suspicious to spam

• p=reject: Refuse unauthenticated messages

Email Security - User Best Practices

Sender Verification:

• Examine actual sender email address (not just display name)

• Review headers for authentication failures

Link Inspection:

• Hover over links before clicking; verify domain matches sender

Contact Verification:

• Independently verify requests via phone/secure channel

Attachment Caution:

• Never open attachments from untrusted sources

Security Tools:

• Use anti-phishing browser extensions

Email Security - Organization Best Practices

Authentication Deployment:

• Implement SPF, DKIM, DMARC; enforce p=reject policy

TLS Encryption:

• Require TLS for SMTP connections

Email Gateway Security:

• Deploy advanced threat protection, sandboxing, URL rewriting

User Training:

• Regular phishing awareness and security training

Incident Response:

• Establish procedures for reporting and handling security incidents

Key Takeaways

• SMTP sends emails; POP3 and IMAP retrieve them

• SMTP is push protocol, POP3/IMAP are pull protocols

• IMAP enables synchronization; POP3 for offline access

• Email headers contain routing and authentication info

• Spoofing exploits lack of SMTP authentication

• Phishing combines spoofing with social engineering

• SPF, DKIM, DMARC provide authentication and policy

• User awareness and organizational controls essential

Questions?