How Email Delivery Works

Sending an email feels instant, but a message normally crosses several systems. Understanding the journey explains what shows up in the headers and why.

1. Composition and submission

A mail client or app hands the message to the sender's outgoing mail server using SMTP submission, usually after logging in. This is where protocols such as ESMTPSA appear in the first Received header. The server adds headers such as Message-ID and Date if the client did not.

2. Finding the destination: MX records

The sending server looks at the recipient's domain and asks DNS for its MX records, which list the servers that accept mail, in priority order. It then opens an SMTP connection to the first reachable one.

3. SMTP between servers

EHLO mail.example.com
MAIL FROM:<[email protected]>
RCPT TO:<[email protected]>
DATA
...headers and body...
.

MAIL FROM becomes the Return-Path and is the identity SPF checks. The receiving server records the connection in a Received header and may start TLS with STARTTLS, which is why ESMTPS shows up.

4. Checks and filtering

The receiving side evaluates SPF, verifies DKIM signatures, applies DMARC policy and runs spam and malware filters. It records results in headers such as Authentication-Results. A gateway may forward the message internally to a mailbox server, adding more Received lines.

5. Delivery to the mailbox

A final system, often over LMTP, stores the message. Your mail app then reads it using IMAP or a similar protocol. That final step does not add to the route, since it is a mailbox read rather than another hop.

What each step leaves behind

The Email Header Analyzer reconstructs this route from the Received headers so you can see each hop. For troubleshooting a message that never arrived, the sender's mail server logs are the other half of the story, and the Log Sanitizer helps you share those logs without exposing addresses and IPs.