Skip to content

How Email Works: From Send Button to Inbox

Follow an email from your device to the recipient's inbox: SMTP servers, DNS lookups, IMAP and POP, and how spam and spoofing checks fit in.

FactNest Editorial Team

· Updated · 5 min read

How Email Works: From Send Button to Inbox

Email is more than fifty years old, yet it remains one of the most widely used ways to communicate. Behind a simple Send button is a chain of servers and agreed standards that move your message across the internet.

Key takeaways

  • Email uses standard protocols: SMTP to send and IMAP or POP to retrieve.
  • DNS records tell your provider which server accepts mail for a domain.
  • Messages pass between mail servers, sometimes through several hops.
  • Authentication methods such as SPF, DKIM and DMARC help detect forged senders.
  • Email is not private by default unless it is encrypted end to end.

Writing and sending

When you write a message in an email app or website, it is handed to your provider's outgoing mail server. That server uses the Simple Mail Transfer Protocol, SMTP, the standard for sending email between servers. The message has a header, containing details such as sender, recipient, subject and routing information, and a body.

Finding the destination

If you send mail to someone at example.com, your provider needs to know which server handles that domain's mail. It asks the Domain Name System, DNS, for the domain's MX records, which list the mail servers and their priorities. Your server then connects to the recipient's server and delivers the message using SMTP.

Storage and retrieval

The receiving server stores the message in the recipient's mailbox. The recipient then reads it using an email client or webmail. Two protocols are common for retrieval. IMAP keeps messages on the server and syncs them across devices, so what you read on a phone also appears as read on a laptop. POP downloads messages to one device and often removes them from the server, which is simpler but less convenient for multiple devices.

Hops and delays

A message may pass through more than one server on its way, for instance a company's filter or a forwarding service. Each adds lines to the header, so a full header acts like a travel log. Most mail arrives within seconds, but a server that is temporarily unavailable will retry delivery for a period before reporting failure.

Spam and forged senders

Because early email standards did not verify senders, spam and phishing are common. Several checks help:

  • SPF lets a domain list which servers may send mail for it.
  • DKIM adds a digital signature that proves the message was not altered.
  • DMARC tells receivers what to do when SPF or DKIM checks fail.

Providers also use filters that look at content, sender reputation and user reports.

Privacy and security

Many connections between servers are encrypted in transit, but your provider may still be able to read stored messages. End-to-end encrypted services exist but need support from both sides. Treat unexpected attachments and links with caution, and never share passwords by email.

Anatomy of an email address and its headers

An email address has two parts separated by an at sign: the local part, which identifies a mailbox, and the domain, which identifies the mail service. Behind every message are headers, lines of information that most email programs hide. They include who sent it and to whom, the date, a unique message identifier and a series of lines added by each server the message passed through. Reading the headers from bottom to top can show the path a message took, which helps investigators trace spam or work out why a message was delayed. Most email apps have a show original or view source option.

Spam, phishing and staying safe

Phishing emails try to trick people into clicking a link, opening an attachment or giving away passwords. Warning signs include urgent threats, unexpected requests for money or login details, mismatched sender addresses, spelling errors and links whose destination differs from the text. If you are unsure, do not click. Go to the organisation's website by typing the address yourself, or contact them through a known number. Keep software updated, use unique passwords with multi-factor authentication, and report suspicious messages to your provider or your organisation's security team.

Encryption and privacy

Most modern email services use Transport Layer Security to encrypt messages as they travel between servers, which protects them from casual snooping on the network. However, the provider can usually read messages stored on its servers. End-to-end encryption, using standards such as PGP or S/MIME, means only the sender and recipient can read the content, but it requires both people to use compatible tools and to manage keys. Some email services offer built-in end-to-end encryption, usually with some trade-offs in features. For truly sensitive information, consider a secure messaging app or an encrypted file share.

Email etiquette and productivity

A few habits make email work better. Write a clear subject line that says what the message is about, and put the key request in the first lines. Keep messages short, use bullet points for several items and say what you need and by when. Reply-all only when everyone needs the answer. To avoid being swamped, check email at set times instead of constantly, unsubscribe from newsletters you do not read, and use folders or filters. Some people aim for an empty inbox by processing each message once, but any system you can keep up is fine.

Email and alternatives

Team chat tools, project boards and video calls have taken over some of what email once did, especially quick questions. Email remains valuable for formal messages, communication between organisations, receipts and records, because it is open, works across providers and can be searched and archived. Many people use a mix, choosing the tool that fits the message.

Frequently asked questions

What do CC and BCC mean?

CC sends a copy visible to all recipients. BCC sends a copy without showing that address to the others.

Why do some emails land in spam?

Filters may flag messages that fail authentication, resemble known spam or come from senders with a poor reputation.

Is a webmail account different from email?

Webmail, such as a browser-based inbox, is simply a way to use your mail account. It talks to the same underlying systems.

What is an email header?

A header is the hidden information attached to an email, listing the sender, recipients, date, subject and the path the message took across servers. It can help trace the origin of a message and diagnose delivery problems.

Why do emails bounce?

Common reasons are a mistyped address, a full or disabled mailbox, a recipient server that rejects the message, or the message being blocked as spam. The bounce message usually contains an error code and explanation that helps identify the cause.

How can I spot a phishing email?

Look for urgency, unexpected attachments or links, requests for passwords or payment details, a sender address that does not match the organisation, and generic greetings. If in doubt, do not click, and contact the organisation through an official channel.

Sources and further reading

Share this article

Written by

FactNest Editorial Team

FactNest is operated by Muonix. The FactNest Editorial Team publishes general-interest explainers with AI-assisted drafting and illustrations. Contact contact@muonix.co for questions or corrections; we respond within 2 business days.

More from this author →

Keep exploring

Related Articles

The FactNest Letter

Stay Curious. Stay Informed.

Get fascinating discoveries, useful guides, and fresh insights delivered straight to your inbox.