SMTP (Simple Mail Transer Protocol)
Objective is to learn how properly analyze emails.
SMTP is a basic protocol for sending email over the internet.
It is referred to as the “push” protocol because messages are sent directly from the sender’s e-mail server to the recipient’s e-mail server.
SMTP does not encrpyt the contents of the mesage by default, which leaves the contents of the message vulnerable to interception or modification. Additional measures such as TLS (Transport Layer Security) can minizse these weaknesses.
SMTP is a text-based protocol of commands and responses.
Some commmands used in the SMTP protocol are:
EHLO: Used by the SMTP client to authenticate itself during communication with serverand to obtain a list of commands supported by the server.
MAILFROM: Identifies sender’s email address.
RCPT TO: identifies recipient’s email address.
DATA: Specifies start of the header, body of email, and containes the text data to be sent after this command.
QUIT: End’s the SMTP client’s communication with the server ans closes the conection.
SMTP Port 25 vs. Port 587
Port 25
The default and oldest port of SMTP. It’s used for communication between email servers. Server-to-server communication
Security: Blocked or restricted by many Internet Server Providers (ISPs). Emails sent through port 25 are susceptible to spam and fraud. Port should be used to provide a secure way for users to connect to their own e-mail server.
Port 587
Provides a secure way for users to connect to their own e-mail server and send an email.
Security: Preferred port for sending email because it requires the use of encryption (SSL or TLS) to initiate messages, which provides an extra layer of security for user authentication and data integrity.
IMAP and POP3
IMAP (Internet Message Access Protocol) and POP3 (Post Office Protocol version 3)
IMAP
Manages emails on the server and allows users to access emails across mutliple devices. Changes are synchronized across all devices.
Security: Requires persistent server connection and is usually encrypted with SSL/TLS. It is recommended that strong authentication and encryption methods are used due to the risk of credetials being transmitted in clear text.
IMAP Ports
Port 143: starndard unencrypted port. Port is ususally encrypted with (STARTTLS)
What is STARTTLS? A protocol command used to initiate encryption in communication protocols that start as plaintext. Primary used in email and messaging protocols such as SMTP, IMAP, and POP3.
Protocol Upgrade: During an existing communication session, STARTTLS upgrades a plaintext connection to an encrypted one using Transport Layer Security (TLS) or its predecessor, Secure Socket Layer (SSL).
Command-Based: In protocols like SMTP, IMAP, and POP3 is a command that the client sends to the server to request and encrypted connection.
Encryption Activation: After the server acknowledges the STARTTLS command, communication channel is encrypted using TLS, providing confidentiality and intergrity for the data exchange.
Port 993: Provides a secure connection for IMAP and is used for TLS/SSL encrypted communications. Provides security by encrypting email traffic.
POP3
Downloads emails from the server and stores them locally, allowing access to emails without an internet connection. Messages are only viewable on the device there were downloaded.
Security: Encrypted with SSL/TLS, but not as flexible as IMAP. Risk of data loss can increase if no local backups are made.
POP3 Ports
Port 110: Standard unencrypted port for the POP3 protocol. Secure communication can be established by using STARTTLS.
Port 995: Provides for a secure connection for POP3. It used for TLS/SSL encrypted communications. It is recommended for secure email reception as it provides security by encrypting email communication.
### Comparison and Usage Scenarios
IMAP is more suitable for situations requiring constant synchronization and email access on multiple devices.
POP3 is ideal for users who have simle email needs and who usually use a single device to manage their email on a day-to-day basis.