Email and messaging¶

Exercise email-and-messaging-annex.pdf · PDF

The school gave you an email address. Every company you work for will give you another one. You press Send, and a second later the message is in a mailbox on the other side of the world. How does it get there? And why can a criminal write to you with your boss's name on it?

Email is the one messaging system that every organisation in the world shares. Clients, suppliers, the tax office, your future boss: they all have an address, and they all expect you to use it well. Today you will see how a message travels, send one by typing the commands by hand, and learn to spot the fake ones.

What you will learn

Describe the trip of an email with the words mail client, mail server, SMTP and IMAP
Send a message by typing SMTP by hand, and see why the From: line proves nothing
Configure a mail client safely, signing in at the provider with OAuth
Read the headers of a real message to find who really sent it
Write a professional email, and choose between email and team messaging
Spot a phishing message from its signals, and know what to do with it

The @ that joined two machines¶

1971, Cambridge, Massachusetts. Ray Tomlinson, an engineer at the company BBN, has a program that leaves messages for other users of the same computer. He changes it so a message can reach a user of another computer on the ARPANET, the network that became the Internet.

He needs a sign to separate the person from the machine, one that appears in nobody's name. He picks @: user at host. His first test went between two machines standing side by side. More than fifty years later, every address still has the same shape:

marta@tramuntana.internal
user  @ domain

The trip of an email¶

The analogy for this page: email is the postal service. You write a letter, you drop it at your post office, your post office hands it to the receiver's post office, and it waits in the receiver's box until they open it.

A mail client is the program where you write and read mail (Thunderbird, the Gmail web page, the app on your phone). A mail server is the post office: it is always on, while your laptop is not.

Two sets of rules, two protocols:

SMTP (Simple Mail Transfer Protocol): the rules to hand over a letter. It is used twice: client to server, and server to server. Published as RFC 821 by Jon Postel in 1982; the current text is RFC 5321 (2008).
IMAP (Internet Message Access Protocol): the rules to look into your box. The letters stay at the post office, so your phone and your laptop see the same box. Current texts: RFC 3501 (2003) and RFC 9051 (2021).

flowchart LR
    MC["<b>Marta's client</b><br>writes the letter"] -->|"SMTP"| MS["<b>Marta's server</b><br>her post office"]
    MS -.->|"asks DNS: who receives<br>mail for Joan's domain?<br>(MX record)"| DNS["<b>DNS</b>"]
    MS -->|"SMTP"| JS["<b>Joan's server</b><br>keeps the letter<br>in Joan's box"]
    JC["<b>Joan's client</b><br>opens the box"] -->|"IMAP"| JS

How does Marta's server find Joan's? It asks DNS which machine receives the mail of that domain: the MX record (Mail eXchanger).

Careful: the email does not go to your friend's computer

It goes post office to post office, and waits in the box on the receiver's server. Joan's laptop can be switched off for a week; the letter waits for him.

Speak SMTP by hand¶

SMTP is plain text. You can be the mail client yourself, with no program: open a connection with nc and type what Thunderbird would type. In class there is a test mail server called Mailpit, a toy post office that accepts every letter and delivers none. This is the real dialogue (the lines that start with a number come from the server):

$ nc -C MAILHOST 1025
220 a2735bd42bd1 Mailpit ESMTP Service ready
HELO deb-lab
250 a2735bd42bd1 greets deb-lab
MAIL FROM:<pau@tramuntana.internal>
250 2.1.0 Ok
RCPT TO:<class@tramuntana.internal>
250 2.1.5 Ok
DATA
354 Start mail input; end with <CR><LF>.<CR><LF>
From: Pau <pau@tramuntana.internal>
To: class@tramuntana.internal
Subject: Hello from Pau

Typed by hand.
.
250 2.0.0 Ok: queued as 5ruCr9JmEnWPKsS8JFskbr
QUIT
221 2.0.0 a2735bd42bd1 Mailpit ESMTP Service closing transmission channel

Line	Meaning
`220`	The server is ready
`HELO`	The client says its name
`MAIL FROM`, `RCPT TO`	The envelope: who hands the letter over, who gets it
`DATA`	Opens the letter itself: headers (`From`, `To`, `Subject`), one empty line, then the text
`.` alone on a line	Ends the letter
`250`	Accepted
`QUIT`	Closes the connection

The -C option makes nc end each line the way SMTP wants (CR LF, carriage return plus line feed).

The From line proves nothing¶

Now send it again with From: The Director <boss@tramuntana.internal>. The server accepts it. Did it ask anybody for proof? No. The sender writes the From line.

MAIL FROM is written on the envelope; From: is written inside the letter, and your mail program shows only the letter. SMTP was designed in 1982 for a network of universities that trusted each other. So today's servers add checks on top: SPF, DKIM and DMARC verify that the sending server is allowed to send for that domain. The details belong to a security course; for now, know they exist and where to read their verdict.

Ports and encryption¶

Protocol	Job	Port	Remember
SMTP	A server hands mail to another server	25	Post office to post office
SMTP submission	Your client hands mail to your server, with your login	587 or 465	465 is encrypted from the first byte; 587 starts in clear and upgrades with `STARTTLS`
IMAP	Read your box; mail stays on the server	993 (with TLS)	Same box on every device
POP3	Download the mail to one device	995 (with TLS)	Older model: one device, mail usually leaves the server

The ports without encryption exist too (IMAP 143, POP3 110), but RFC 8314 (2018) carries its message in the title: "Cleartext Considered Obsolete". A password in clear text can be read by anyone on the path.

Careful: an email is a postcard, not a sealed letter

TLS protects each hop between two machines, but every post office on the way can read the letter. Never send a password by email.

A mail client, the safe way¶

When you add your school Google account to Thunderbird, it finds the settings by itself and opens a sign-in window. Look at the address bar: it is Google's own page. Thunderbird never sees your password. Google asks you, then gives Thunderbird a key that works only for mail and that you can cancel at any time.

OAuth is that mechanism: you sign in at the provider, and the program receives a limited permission instead of your password.

These are the settings Thunderbird shows for a Google account:

	Server	Port	Security	Authentication
Incoming (IMAP)	`imap.gmail.com`	993	SSL/TLS	OAuth2
Outgoing (SMTP)	`smtp.gmail.com`	465	SSL/TLS	OAuth2

If a program asks you to type your Google password into its own box, or to lower a security setting of your account, the answer is no.

Read the real headers¶

In the Gmail web page, open a message, then the three-dot menu, then Show original. You get:

A summary with the SPF, DKIM and DMARC verdicts: PASS means the sending server was allowed to send for that domain.
The raw headers. The Received: lines are stamps: every server that handled the letter adds one on top, so you read the trip from the bottom up. The lowest one is the first machine that touched the message.

Careful: the name is not the sender

"Aina – Administration" is a name typed by the sender, just like the From: line you forged. Look at the address behind the name and, when it matters, at the SPF / DKIM / DMARC verdict.

Writing a professional email¶

Compare these two:

Subject: hi

hey, its done, check it out when u can

Subject: Office server documentation v1.0 ready for review

Hello Aina,
The documentation of the office server is ready (attached, 14 pages).
Could you check section 3, "Shared folders", before Friday 11 June?

Thank you,
Marta Soler · Development · Tramuntana Apps

The six rules:

A subject that says what and which.
A greeting.
One purpose per message, the most important line first.
A clear request with a date.
Name the attachment in the text.
A signature with name and role.

Three more buttons to use with care:

CC (carbon copy): people who should know, not act.
BCC (blind carbon copy): the other recipients do not see these addresses. Use it when you write to many people who do not know each other.
Reply all: only when all of them need the answer.

Team messaging¶

A team messaging tool groups short messages in channels (one per topic or team), with threads (answers hanging from one message), mentions (@name to call someone) and direct messages.

Its oldest ancestor is IRC, written by Jarkko Oikarinen in Finland in 1988. Office tools like Slack (public in 2014) and Microsoft Teams (2017) made the model common at work.

	Email	Team messaging
Reaches	Anyone with an address, in any organisation	Only the members of the workspace
Rhythm	Slow, complete; one message stands alone	Fast, short; needs the conversation around it
Good for	Clients, suppliers, formal requests, things that must be found in a year	Quick questions, coordination today, the team's daily noise
Risk	Phishing, long reply-all chains	Interruptions; decisions lost in the scroll

A password goes by neither.

Phishing: when the letter lies¶

Phishing is a fake message that pretends to come from someone you trust, to make you click, log in, pay or reveal something.

Between 2013 and 2015, a man in Lithuania, Evaldas Rimašauskas, sent emails with invoices to two companies, pretending to be a real hardware supplier they worked with. The companies paid more than 100 million dollars in total. They were Google and Facebook. He pleaded guilty in a New York court in 2019. No virus, no hacking: only emails that looked right.

The signals to look for:

Signal	Example
Urgency or threat	"Your mailbox closes TODAY"
Asks you to log in through a link	"Log in here in the next 2 hours"
The address is not the real domain	`help@tramuntana-helpdesk.example`
The link text and the real target differ	The text says one address; the mouse over it shows another
Unexpected prize or request for card details	"You won a phone"
Right name, wrong address, asks for secrecy or a new bank account	"Pay this invoice to a new account. Do not call."

What to do with a phish:

Do not click, do not reply, do not forward it to colleagues.
Report it (in Gmail: three-dot menu, Report phishing) and tell the person in charge by another channel, like a phone call.
If you already typed your password: change it at once, and say so. Nobody is punished for reporting.

Key takeaways¶

A mail client writes and reads; a mail server is the always-on post office. SMTP hands mail over (client to server, server to server); IMAP reads your box, which stays on the server.
The receiving server is found through the MX record in DNS.
The sender writes the From: line; SMTP does not verify it. SPF, DKIM and DMARC check the sending server, and the Received: headers are read from the bottom up.
Use the encrypted ports (465/587, 993) and sign in with OAuth on the provider's own page; an email is a postcard, so never send a password in one.
A professional email has a precise subject, one purpose, a clear request with a date and a signature; team messaging is for quick coordination inside the team.
Phishing mixes urgency, authority and a false address. Do not click, report it, and verify by another channel.

Quick check¶

1. Which pair of protocols is right?

IMAP sends the mail, SMTP reads the box
SMTP sends the mail, IMAP reads the box
POP3 sends the mail, SMTP reads the box
SMTP sends the mail, DNS reads the box

SMTP hands letters over, from client to server and from server to server. IMAP lets your client look into your box on the server. DNS only tells the sending server where to deliver.

2. You read your mail on a phone and on a laptop. Why use IMAP?

It is the only protocol that can be encrypted
It works without a password
The mail stays on the server, so both devices see the same box
It is faster than SMTP at sending

With IMAP the letters stay at the post office, and every device looks into the same box. POP3 is the older model that downloads the mail to one device.

3. Why can a message show your boss's name when it was not sent by your boss?

The sender types the From line, and SMTP does not verify it
IMAP changes the sender's name on the way
TLS encryption hides the real sender
DNS assigns a random name to each message

You proved it by typing From: The Director by hand: the server accepted it. SMTP was designed for a network that trusted itself; SPF, DKIM and DMARC were added later to check the sending server.

4. A well-written email from your boss asks for an urgent payment to a new bank account, and says not to call. What do you do?

Pay first, then ask your boss about it
Reply to the email to ask for confirmation
Forward it to the whole team as a warning
Do nothing by email; check by phone and report it

Urgency plus authority plus a new bank account is the classic phishing pattern, the one that cost Google and Facebook over 100 million dollars. Replying goes to the criminal; verify by another channel and report it.

5. Where is an email while the receiver's laptop is switched off?

In the sender's outbox, retrying every minute
In the receiver's box on the receiver's mail server
Lost, so the sender must write it again
Inside the DNS server, until the laptop turns on

Mail goes post office to post office. The receiver's mail server is always on and keeps the letter in the box until a client opens it with IMAP.

6. Thunderbird opens a window to sign in to your school Google account. What makes it safe?

The window belongs to Thunderbird, which stores your password encrypted
The page is Google's own, and Thunderbird only receives a limited key
You first lower the security settings of your account
It uses POP3, which does not need a password

With OAuth you sign in on the provider's own page. The program gets a limited permission for mail that you can cancel, and never sees your password.

7. In the raw headers of a message there are four Received: lines. Which one shows the first machine that handled it?

The top one
The bottom one
The one with the longest name
None of them shows it

Each server that handles the letter adds its Received: stamp on top, so the trip is read from the bottom up: the lowest line is the first machine.

8. Pick the two that belong in an email rather than in team chat.

A price quote for a client
A holiday request to the administration department
Is the server down for you too?
The admin password of the office server

Email reaches anyone, in any organisation, and is easy to find a year later: good for clients and formal requests. Quick questions go to team messaging. A password goes by neither.

Next: an attachment has a size limit and travels as a postcard. How do you move a whole folder to a server, safely? File transfer.