What is SMTP? How the Simple Mail Transfer Protocol sends email

Editorial team · updated 24 September 2026 · facts checked 24 September 2026

SMTP (Simple Mail Transfer Protocol) is the standard that sends email across the internet. Defined in RFC 5321, it carries a message from an app or mail client to a sending server, then between servers until it reaches the recipient's mail server. Reading mail is a separate job, done with IMAP or POP3.

Apps rarely run a mail server: they log in to a provider's SMTP relay on port 587 or 465, which delivers onward on port 25. Nodemailer, PHPMailer, CMS plugins and Supabase Auth work this way.

How an SMTP session works

Client and server trade text commands and three-digit replies over TCP. One receipt, simplified from the examples in RFC 5321 and RFC 4954:

Illustrative code, written from the official documentation and not run by the editorial team.

S: 220 smtp.example.com ESMTP ready
C: EHLO app.example.org
S: 250-smtp.example.com greets app.example.org
S: 250 STARTTLS
C: STARTTLS
S: 220 Ready to start TLS
   (TLS handshake; the client sends EHLO again)
S: 250 AUTH PLAIN LOGIN
C: AUTH PLAIN <base64 username and password>
S: 235 2.7.0 Authentication successful
C: MAIL FROM:<bounces@example.org>
S: 250 OK
C: RCPT TO:<ana@example.net>
S: 250 OK
C: DATA
S: 354 Start mail input; end with <CRLF>.<CRLF>
C: From: Example Shop <receipts@example.org>
C: (more headers, a blank line, the body)
C: .
S: 250 OK
C: QUIT
S: 221 Bye

MAIL FROM sets the envelope sender, where bounces go and the domain SPF checks; the From: header inside DATA is what people see, and the two can differ. Each recipient gets a RCPT TO. A line holding one dot ends the RFC 5322 message. Once the server answers it with 250, "a formal handoff of responsibility for the message occurs" (RFC 5321 §2.1): delivery or a bounce is now the server's job.

The reply's first digit says what happens next (§4.2.1): 2xx done (250, or 235 after login); 3xx send more (354); 4xx temporary, and the client "SHOULD try again" (421 from a busy server); 5xx permanent, don't repeat it (550 unknown mailbox, 535 failed login).

SMTP ports: 25, 587 and 465

• 25: relay between servers. MX records can't name a port, so server-to-server mail always uses 25 (RFC 8314 §7.3).
• 587: submission from apps and mail clients (RFC 6409), upgraded to TLS with STARTTLS (RFC 3207).
• 465: submission over implicit TLS, encrypted from the first byte. RFC 8314 asks for both 587 and 465 and sees "no significant difference" in security when TLS is required.

Ports such as 2525 are provider extras, not standards.

Clouds block outbound port 25 to curb spam and abuse. On 24 September 2026, AWS blocked it on EC2 and Lambda until you request removal, Google Cloud to external addresses, and Azure on VMs outside standard Enterprise Agreement and MCA-E subscriptions; DigitalOcean blocked 25, 465 and 587 on all Droplets. Relay submission doesn't need 25.

SMTP authentication, SPF, DKIM and DMARC

SMTP AUTH (RFC 4954) proves to the relay that you may send, as in the session above: 235 accepts the login, 535 rejects it. PLAIN only base64-encodes the password, and RFC 4954 says servers "SHOULD NOT" accept it without TLS or similar protection. Many relays take an API key as the password with a fixed username (apikey at SendGrid, resend at Resend, App at Infobip); Brevo issues an SMTP key, Amazon SES per-Region credentials.

Domain authentication is checked by the receiving server:

• SPF (RFC 7208): DNS list of servers allowed to send for the MAIL FROM domain.
• DKIM (RFC 6376): a header signature checked against a public key in DNS.
• DMARC (RFC 9989, May 2026, replacing RFC 7489): tells receivers what to do when neither SPF nor DKIM passes for the visible From: domain, and where to send reports.

Gmail requires SPF or DKIM and a TLS connection from every sender, and SPF, DKIM and DMARC from senders of more than 5,000 messages a day to Gmail accounts. The transactional email guide covers the DNS records.

SMTP relay vs an email API

A relay takes a finished MIME message after an SMTP login; an email API takes JSON over HTTPS, returns a message ID and, at a few providers, accepts idempotency keys. Most providers offer both; the email API vs SMTP relay comparison covers errors, retries and blocked ports.

SMTP from serverless functions

Supabase Edge Functions refuse outgoing connections to ports 25 and 587; Cloudflare Workers can't open port 25 by default. Nodemailer waits 120 seconds for a connection and keeps idle sockets 10 minutes by default, while a Vercel Function stops at 300 seconds by default. Set shorter timeouts or use an HTTPS API. Supabase Auth's email cap is a separate issue, covered by the Supabase rate limit fix.

Which email providers offer an SMTP relay

Of the 14 transactional email providers in our dataset, 12 document a relay. Telnyx is API-only; Zenvia has no recorded answer. Rows are alphabetical; the scored order is in the transactional email rankings, per our methodology. Hosts and ports as each provider's SMTP docs printed them on 24 September 2026; free options from the provider cards, checked the same day:

Connections are capped: 10 at once at Bird and Mailtrap, 40 at SMTP2GO with up to 5,000 emails each. Postmark calls its SMTP endpoint "a migration route" that accepts every message and reports bounces later. Card rules, account approval and upgrade prices are in free email API and SMTP relay tiers, MCP servers and agent skills in the AI readiness data.

Related guides

• Email API vs SMTP relay
• Transactional email guide
• Supabase "email rate limit exceeded" fix
• Free email API and SMTP relay tiers

About this guide

The PingMyUsers editorial team wrote this entry for developers and AI coding agents adding email to an app. Sensaria AG (Switzerland) operates the directory; no provider paid for placement or reviewed this page. Report errors, with a source, to contact@sensaria.ch.

Methodology

On 24 September 2026 we read the RFCs cited here and their status records at rfc-editor.org, the IETF datatracker entry for RFC 5321's revision, seven cloud and serverless pages, and the 13 providers' SMTP docs. We did not open accounts or send email. Section order follows 83 AI-search queries from three earlier research runs.

Last updated

24 September 2026: first version. Next re-check: March 2027, or when RFC 5321's revision is published.

Frequently asked questions

What is an SMTP server?

Any server that accepts email over SMTP: a relay takes mail from apps after a login on 587 or 465, an MX server receives mail for its domain on 25.

Should I use port 587 or 465?

Either, with TLS required; RFC 8314 sees no significant security difference. Use 587 for STARTTLS, 465 if your library offers "SSL/TLS".

What is the difference between SMTP and IMAP?

SMTP sends and relays mail; IMAP and POP3 let a mail client read stored mail. An app that only sends doesn't need IMAP.

Why is port 25 blocked?

To curb spam and abuse, say AWS, DigitalOcean and Google Cloud. Apps don't need it: relays take authenticated mail on 587 or 465.

Is SMTP still used?

Yes. Mail between servers travels over SMTP, even after your provider accepts it through an HTTPS API. SMTP dates from RFC 821 (August 1982); RFC 5321 (October 2008) is current, and its revision sat in the RFC Editor queue on 24 September 2026.