Day 1 - Mail Services: The MTA, MDA, MUA and SMTP, POP3, IMAP Triangle

📌 Key Takeaways

• The mail system has an asymmetric structure: "SMTP to send, POP3/IMAP to retrieve." Once you can sketch this asymmetry, the ports and config files fall into place.
• Division of roles: MUA (user client) → MTA (server-to-server transfer) → MDA (final delivery to the mailbox).
• Ports to answer instantly: SMTP 25 · POP3 110 · IMAP 143, and the encrypted ones: SMTPS 465 · Submission 587 · IMAPS 993 · POP3S 995.
• POP3 downloads and deletes from the server (single device), IMAP keeps mail on the server and syncs (multiple devices). "Multiple devices = IMAP".
• The MTAs are Sendmail (legacy, /etc/mail/sendmail.cf) and Postfix (modular, secure, /etc/postfix/main.cf). Opening mynetworks too wide creates an open relay.

The 3 Components of a Mail System — MTA, MDA, MUA

• Mail isn't exchanged directly by people; it is delivered by a relay of three programs with separate roles.

• Drawn in one line, the flow looks like this.

[Sender MUA] --SMTP--> [Sending MTA] --SMTP--> [Receiving MTA] --MDA--> [Mailbox]
                                                              ↑
                          [Recipient MUA] <--POP3/IMAP-- [Mailbox]

The MTA is "the truck hauling between post offices," the MDA is "the mail carrier dropping letters into the mailbox," and the MUA is "a person writing and reading letters." MTAs talk to each other over SMTP, the MDA drops the mail into the mailbox, and then the MUA looks into that mailbox over POP3/IMAP. This division of labor is the backbone of the mail architecture.

Key distinction: MTA and MDA are different stages. The MTA is the transfer stage that moves mail from server to server, while the MDA is the final delivery stage that drops that mail into the local user's mailbox. SMTP is the language of the MTA; POP3/IMAP are the language of the MUA that reads the mailbox.

Mail Protocols and Ports — The Asymmetry of Sending and Receiving

• This is what the practical exam asks about. You must memorize the port numbers outright.

Points to lock into memory:

• Sending = SMTP = 25, secure sending = 465 / 587
• POP3 = 110 → 995, IMAP = 143 → 993 (memorizing both by their ending-digit pattern is safe)
• 25 is the standard for relaying between MTAs, 587 is the authenticated port where users "submit" mail

⚠️ Trap: Some questions mix up 465 and 587. 465 is SMTPS, which wraps the connection in SSL from the start; 587 is the mail submission port that starts in plaintext and is encrypted via STARTTLS. Also, a choice that flips the direction to "receiving = 110/143, sending = 25" is wrong. A choice that attaches 25 to POP3 is wrong as well.

Key distinction: POP3 vs IMAP — POP3 downloads mail to the client and deletes it from the server (by default), so it suits use on a single device. IMAP leaves mail on the server and syncs, so it suits viewing the same mailbox from multiple devices. "Syncing across multiple devices = IMAP" is the signal for the correct answer.

Try It Yourself — Checking Ports and Services

# Check whether the mail-related ports are LISTENing
ss -tlnp | grep -E ':(25|110|143|465|587|993|995)'
 
# Check the standard port definitions in /etc/services
grep -E '^(smtp|pop3|imap|submission|imaps|pop3s)\b' /etc/services
 
# Local mail delivery test (SMTP conversation via telnet)
telnet localhost 25
# Response: 220 mail.example.com ESMTP Postfix

SMTP uses port 25 because it is a historical number assigned back in 1982 in RFC 821. Later, as ISPs blocked outbound port 25 to stop spam, port 587 (RFC 4409) was split off for authenticated users to submit mail. That is why a large share of today's "mail goes out but I can only receive" outages are caused by port 25 being blocked.

Sendmail vs Postfix — The Showdown of Two MTAs

• Linux's two representative MTAs are the traditional Sendmail and the modern Postfix.
• The exam asks about the differences between the two and their config file locations.

Postfix replaced Sendmail because "one huge process" was the weak point for security. Postfix splits receiving, queueing, and delivery into small processes with different privileges, designed so that a breach in one part doesn't spread to the whole. "Security and modular = Postfix" is the key.

Postfix main.cf Key Directives

# /etc/postfix/main.cf — key settings
myhostname = mail.example.com      # This server's hostname
mydomain = example.com             # Domain name
myorigin = $mydomain               # Domain for outgoing mail (fixes up the sender address)
inet_interfaces = all              # Interfaces to listen on (all = every NIC)
mydestination = $myhostname, localhost, $mydomain   # Domains treated as local delivery
mynetworks = 127.0.0.0/8, 192.168.0.0/24            # Trusted networks allowed to relay
relayhost = [smtp.isp.com]:587     # Relay server that outbound mail goes through
home_mailbox = Maildir/            # Mailbox format (Maildir/ vs mbox)

• After changing the configuration, it must be reloaded.

postconf -n                # Print only settings that differ from the defaults (for checking)
postfix check              # Check config syntax
systemctl reload postfix   # Apply config changes without downtime
newaliases                 # Rebuild the DB after changing /etc/aliases

⚠️ Trap: If you set inet_interfaces to localhost, the server can't receive mail from outside. Also, if you open the mynetworks range too wide (e.g., 0.0.0.0/0), anyone can relay mail through this server, making it an open relay that gets abused as a spam source. They pair up as "can't receive = inet_interfaces, open relay risk = mynetworks".

Key distinction: Mailbox storage format mbox vs Maildir — mbox appends all mail into a single file, so lock conflicts are frequent, while Maildir stores each message as one file in a directory, which is safe for concurrent access. A value ending in a slash (/), like home_mailbox = Maildir/, is the signal for Maildir format.

Mail Aliases and Queue Management

# /etc/aliases — redirect recipient addresses (aliases)
root:       admin@example.com    # Forward mail addressed to root to admin
webmaster:  root                 # Multi-level aliases are also possible
# After editing, always run
newaliases
 
# Check and handle the mail queue
mailq              # Show the pending mail queue (same as postqueue -p)
postqueue -f       # Flush the queue immediately (try resending)
postsuper -d ALL   # Delete all mail in the queue

It is common for mail not to go out right away and pile up in the queue. Because of a temporary outage on the receiving server, a DNS MX lookup failure, greylisting, and so on, the MTA doesn't discard the mail but keeps it in the queue and retries periodically. So when a report comes in that "mail is delayed," the first thing to do is check the queue state with mailq. This is the mail administrator's first diagnostic command.

Pre-Exam Checklist

• Answer instantly: 25 (SMTP), 110 (POP3), 143 (IMAP), 465 (SMTPS), 587 (submission), 993 (IMAPS), 995 (POP3S)
• MTA (server-to-server transfer) ≠ MDA (mailbox delivery) ≠ MUA (user client)
• Postfix config is /etc/postfix/main.cf, Sendmail's is /etc/mail/sendmail.cf
• POP3 = download then delete, IMAP = keep on server and sync
• To prevent an open relay, keep mynetworks narrow

📖 Glossary

• MUA (Mail User Agent) : The client where people write and read mail. Outlook, Thunderbird, mutt, etc.
• MTA (Mail Transfer Agent) : The transfer engine that moves mail from server to server. Sendmail and Postfix are the typical ones.
• MDA (Mail Delivery Agent) : Handles the final delivery, dropping mail the MTA has received into the local user's mailbox.
• SMTP : The protocol for sending mail. Both MUA→MTA and MTA→MTA use it.
• submission (587) : The dedicated port where users submit mail after authenticating. Encrypted with STARTTLS.
• SMTPS (465) : A sending port that connects wrapped in SSL from the start. Easy to confuse with 587.
• POP3 vs IMAP : Download-and-delete-from-server (single device) / keep-on-server-and-sync (multiple devices).
• inet_interfaces : The interfaces on which Postfix receives mail. If set to localhost, it can't receive outside mail.
• mynetworks : The trusted networks allowed to relay. Too wide makes an open relay.
• Open relay : A state where anyone can relay mail through this server. Abused as a spam source.
• relayhost : Specifies the relay server that outbound mail passes through instead of being sent directly.
• mbox vs Maildir : Appending all mail into one file / storing each message as one file (safe for concurrent access).
• /etc/aliases : The alias file that forwards a recipient address to another address. After editing, you must rebuild the DB with newaliases.
• Mail queue : Where mail that couldn't be sent immediately piles up awaiting retry. View it with mailq and push it out with postqueue -f.