The conversation

The sending server connects to the receiving server's MX host, usually on port 25. It says EHLO and its hostname; the receiver replies with what it supports. The sender says STARTTLS and the session becomes encrypted. Then MAIL FROM with the envelope sender, RCPT TO with each recipient, DATA with the headers and body, and a final dot. At every step the receiver answers with a three-digit code: 2xx accepted, 4xx try later, 5xx refused.

Submission — a mail client or sending tool handing a message to its own provider — uses the same protocol on port 587 (or 465 with implicit TLS) with a username and password. Port 25 is for server-to-server delivery and is blocked by most consumer networks.

Envelope versus header

The address in MAIL FROM is the envelope sender, also called the return-path; bounces go there and SPF is checked against its domain. The From: your recipient sees is inside the DATA, a header like any other, and nothing in SMTP ties it to the envelope. That gap is the reason DMARC alignment exists: it requires the two to agree, or requires DKIM to sign for the header domain.

Where the failures live

Rate limits are the receiver replying 4xx to RCPT TO or DATA. Authentication failures are 5xx at DATA, after the receiver has read the headers and run SPF, DKIM and DMARC. Blacklist rejections often come at connection time, before EHLO is even acknowledged. Reverse DNS is checked against the connecting IP the moment the connection opens. Reading a bounce with this sequence in mind tells you which stage refused you and, therefore, what kind of problem it is.

Check yours

These run free in your browser. Nothing you type reaches a server.

Common questions