We send and receive emails just about every day, rarely thinking about how it works or whether the process is secure. However, choosing the wrong email protocol can cause problems ranging from limited storage space on your computer to data breaches, loss of customer trust, or blocked domains.
This guide outlines how email protocols work, explains the critical difference between functionality and security, and provides a checklist for SMBs.
Email protocols explained(nové okno)
Email security protocols(nové okno)
How protocols impact email marketing success(nové okno)
An email protocol security checklist for SMBs(nové okno)
A quick email glossary
The terminology around emails all sounds very similar, but the distinctions are important. Here’s what we’ll be discussing in this guide:
Email client: The software application you use to read, write, and manage your emails, such as Outlook, Apple Mail, and Proton Mail.
Email protocol: The set of rules that governs how emails are transmitted, received, and stored across the internet. Core protocols like SMTP, IMAP, and POP3 handle the mechanical movement of messages between servers and clients.
Email security protocol: A protective layer of standards that sits on top of core email protocols to ensure privacy and data integrity. These include encryption methods like TLS (for transit) and S/MIME or PGP (for end-to-end content), as well as mechanisms to detect malware or spam.
Email authentication: The process of verifying that an email truly originates from the domain it claims to represent. It relies on the trio of SPF, DKIM, and DMARC to instruct receiving servers on whether to trust, flag, or reject a message, preventing spoofing and phishing.
Email marketing tool: A platform designed to create, send, and track bulk email campaigns, such as Mailchimp, HubSpot, or SendGrid. These tools utilize SMTP to deliver messages and depend heavily on proper email authentication to ensure high deliverability rates.
Email protocols explained
1. Simple Mail Transfer Protocol (SMTP)
What it is: The standard protocol for sending emails. SMTP handles the transfer from your email client to the server, and between servers.
How it works: Your email client connects to an SMTP server, authenticates, and hands off the message. The server then routes it to the recipient’s domain. It’s not possible to send an email without SMTP.
Security note: Standard SMTP sends data in plain text. Without encryption (STARTTLS), sensitive business data can be intercepted.
2. Internet Message Access Protocol (IMAP)
What it is: The modern standard for receiving and managing emails. IMAP keeps messages on the server and syncs them across all your devices.
How it works: When you check your email on your phone, laptop, or tablet, IMAP fetches the latest status from the central server. Because the email is stored on the server, if a laptop is lost, the email history remains safe. Similarly, deleting an email on one device deletes it everywhere.
Security note: Because data resides on the server, strong authentication and encryption are non-negotiable.
3. Post Office Protocol v3 (POP3)
What it is: An older protocol that downloads emails to a single device and typically deletes them from the server.
How it works: The email client connects, downloads all new messages, and disconnects. The server is left empty. This protocol is rarely recommended for modern businesses; it creates data silos (if your device crashes, your email history is gone), and because all emails are downloaded to your device, it can create storage issues on your computer.
Security note: Lack of server-side redundancy makes it vulnerable to hardware failure and theft. This high-risk protocol is not recommended, especially for businesses.
Read more: What are SMTP, IMAP, and POP3?
SMTP and IMAP serve opposite purposes, but a functional email setup requires both protocols. SMTP sends messages out, while IMAP retrieves incoming messages. Most modern email providers hide this complexity, and the software automatically configures both the SMTP and IMAP settings in the background. You rarely have to think about which one you’re using—the software simply handles both simultaneously.
Email security protocols
Email protocols move and store messages, but email security protocols are the systems that keep emails, senders, and recipients safe. They fall into two categories: those that encrypt data to keep it private, and those that authenticate senders to prove identity.
Encryption protocols
Transport Layer Security (TLS): Encrypts the connection between mail servers as emails travel across the internet. Most modern email providers enforce TLS by default.
STARTTLS: A command that upgrades an existing unencrypted connection to a secure TLS connection. If the other side doesn’t support it, the connection falls back to plain text, which is a potential vulnerability.
Secure/Multipurpose Internet Mail Extensions (S/MIME): Provides end-to-end encryption and digital signatures at the message level. It requires both sender and recipient to exchange digital certificates, which makes it more common in enterprise environments.
Pretty Good Privacy (PGP) / GNU Privacy Guard (GPG): Another method of end-to-end encryption and digital signing that offers strong privacy. Instead of certificates, PGP uses a web-of-trust model where users exchange public keys directly.
Authentication protocols
Sender Policy Framework (SPF): Lets a domain owner publish a list of authorized IP addresses that are permitted to send emails on behalf of that domain. When a receiving server gets a message, it checks the sender’s IP against this list. If the IP isn’t on it, the email fails SPF.
DomainKeys Identified Mail (DKIM): Adds a cryptographic signature to each outgoing email, tied to the sending domain. The receiving server verifies this signature against a public key published in the sender’s DNS records.
Domain-based Message Authentication, Reporting, and Conformance (DMARC): Ties SPF and DKIM together and gives domain owners control over what happens when authentication fails. Through a DMARC policy, you can instruct receiving servers to accept, quarantine, or reject failed messages, and you receive reports showing who is attempting to send unauthorized emails from your domain.
Why this matters for SMBs
Without security protocols layered on top of your core protocols, you’re at risk of:
- Spoofing: Attackers can easily impersonate your domain to scam your customers
- Interception: Unencrypted traffic allows hackers to read emails in transit
- Blacklisting: Poor authentication leads to your domain being flagged as spam
Together, these email security protocols create a layered defense—encryption keeps prying eyes off the content, and authentication ensures the email actually came from who it claims to be from.
How protocols impact email marketing success
For SMBs, email marketing introduces a wrinkle: you may not be the one sending the emails. Whether you use a marketing tool or run campaigns yourself determines what you’re responsible for securing.
If you’re using a marketing tool
Platforms like Mailchimp, HubSpot, and SendGrid handle the sending infrastructure, including SMTP servers and encryption. But they can’t authenticate your domain on your behalf. That part is yours.
When a marketing tool sends an email using your domain, for example, newsletter@yourcompany.com, the recipient’s server still checks your domain’s authentication records:
- SPF: Must include the marketing tool’s sending IPs so the recipient’s server knows they’re authorized to send on your behalf.
- DKIM: The marketing tool signs the email with a cryptographic key, but you must publish the corresponding public key in your DNS records so the recipient can verify it.
- DMARC: Tells receiving servers what to do if SPF or DKIM fails, and sends you reports so you can monitor for unauthorized use of your domain.
Most reputable marketing tools walk you through this DNS setup during onboarding. If yours doesn’t, that’s a red flag.
If you’re running your own campaign
Sending bulk emails from your own SMTP server puts the full responsibility on you. You need to:
- Configure your SMTP server to use TLS/STARTTLS for encrypted transmission
- Set up SPF, DKIM, and DMARC records for your domain
- Monitor your sender reputation—shared or poorly managed SMTP servers are a common route to blocklisting
- Start with a low sending volume and increase it slowly over time to build trust with inbox providers
This approach gives you more control but requires significantly more technical expertise and ongoing maintenance. For most SMBs, a reputable marketing tool is the safer and simpler path.
Data ownership and business continuity
For an SMB, email isn’t just communication; it’s a record of transactions, agreements, and client relationships.
The POP3 trap: If your team uses POP3 and an employee’s laptop crashes, you may lose years of correspondence permanently because the data was never saved on the server.
The IMAP advantage: By keeping emails on the server, you ensure that data survives hardware failures and employee turnover. It also allows administrators to archive and search communications for compliance audits.
Even if POP3 feels cheaper or simpler, the risk of losing critical business data makes IMAP the safest option for a growing company.
An email protocol security checklist for SMBs
Ready to secure your email infrastructure? Follow this step-by-step guide:
- Audit your current setup:
- Are you using TLS/STARTTLS for all connections? (Check your provider settings).
- Are you still using POP3? If so, plan a migration to IMAP immediately.
- Implement authentication records:
- Log in to your DNS provider.
- Add your SPF record (include all authorized sending IPs).
- Generate and publish your DKIM key.
- Set up a DMARC policy (start with monitoring).
- Secure your marketing stack:
- Ensure your email marketing platform is configured to send via your custom email domain, not a generic subdomain.
- Verify that your domain passes all three authentication checks before sending bulk campaigns.
- Test and monitor:
- Send test emails to Gmail, Outlook, and Yahoo.
- View the email headers to confirm authentication passed.
- Subscribe to DMARC aggregate reports to monitor for unauthorized usage.
Don’t wait for a breach or a blacklisting event to audit your email infrastructure. Start with the checklist above, and build a system that supports your business growth securely.
Need help implementing end-to-end encryption or securing your business email? Explore Proton’s business solutions for enterprise-grade privacy and security.
