Email

7.2 Email

SMTP

Message transfer agents - Move email across the network.

Source machine establishes TCP socket connection to port 25 on destination machine.

Sample SMTP conversation delivering an email from client C to server S.
Try these out:

$ telnet mail.dcu.ie 25

$ telnet mailhost.computing.dcu.ie 25
help
214-2.0.0 This is sendmail version 8.12.10
214-2.0.0 Topics:
214-2.0.0       HELO    EHLO    MAIL    RCPT    DATA
214-2.0.0       RSET    NOOP    QUIT    HELP    VRFY
214-2.0.0       EXPN    VERB    ETRN    DSN     AUTH
214-2.0.0       STARTTLS

You may not be able to either read or send email though. See below.

Email headers

RFC 822 - SMTP message format
Email headers
How to Get Email Headers on different email clients.

Basic email header fields.
Message consists of:

Header fields
(blank line)
Message body

Other email header fields.
Applications can invent their own. Must begin with X-.
e.g. X-Spam-Status:

Email headers in forensic work

I receive an unpleasant email from Hotmail.
But where is it actually from? America?

"View - Headers - All" (or something similar) in your email client and you can see the actual email headers.
These reveal the path it travelled and also the original IP address, which you can then look up.
Lookup here said it was Eircom, who I then complained to.
I could even see what part of Ireland this came from.

You will soon start spotting stories like this everywhere: Man sends email to MP threatening to kill her children. He is convicted April 2012. How is he caught? "Police traced the malicious email back to Zimmerman's computer by tracking the IP address". Sounds like it was somewhere in the email headers.

MIME

MIME encoding for binary data to be sent by email (designed for text data).
Encodes it as simple plain text 7-bit ASCII chars.

base64 encoding: For binary attachments.
Can encode any binary stream whatsoever as (a really safe subset of) 7-bit ASCII.
"The resultant base64-encoded data has a length that is approximately 33% greater than the original data"

Content-Type: application/msword; name="Postgrad_Prospectus_Research.doc";
 x-mac-type="42494E41"; x-mac-creator="4D535744"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Postgrad_Prospectus_Research.doc"

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAATwAAAAAAAAAA
EAAAUQAAAAEAAAD+////AAAAAE4AAAD/////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////s
pcEATSAJBAAA8BK/AAAAAAAAEAAAAAAABAAAKzIAAA4AYmpiauI94j0AAAAAAAAAAAAAAAAAAAAA
AAAJBBYAIlAAAIBXAACAVwAARywAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//w8AAAAA
AAAAAAD//w8AAAAAAAAAAAD//w8AAAAAAAAAAAAAAAAAAAAAAGwAAAAAAMYBAAAAAAAAxgEAAMYB
AAAAAAAAxgEAAAAAAADGAQAAAAAAAMYBAAAAAAAAxgEAABQAAAAAAAAAAAAAANoBAAAAAAAAshcA
AAAAAACyFwAAAAAAALIXAAAAAAAAshcAABwAAADOFwAAVAAAANoBAAAAAAAAqyQAAIoBAAAuGAAA
....

Quoted-printable encoding: For basically plaintext with 8-bit ASCII chars.
Encodes everything as 7-bit ASCII. The 8-bit chars are encoded as: "=nn".
"=" itself encoded as "=3D".

I have had several enquiries =
regarding=20
IEEE Xplore (full-text access to IEEE and IEE publications) and would =
like to=20
inform you of some recent developments. As part of the<A=20
href=3D"http://www.library.dcu.ie/news/index.htm#HES"> IReL</A> =
initiative (funded=20
by SFI and HEA) to provide increased access to e-journals, negotiations =
for IEEE=20
Xplore are at an advanced stage.

MIME headers.

MIME content types.

HTTP uses these too.

MIME types

Standalone email clients

Email clients - Read and send email.

Standalone email clients came before webmail clients, and are still popular. (I use them.)

With standalone client, you are normally not logged directly onto
mailhost.computing.dcu.ie
or mail.dcu.ie
or whatever machine receives your email when you are offline, such as:
mailhost.isp.com

Rather it is a client-server model (like the web). You connect to the mail host machine sporadically over the network from your client.

(a) Email when you are permanently on the network.
(b) Email when you are not permanently on the network.

POP3

The original protocol for standalone clients.

POP3 client sets up TCP connection to the mail server at port 110.

POP3
POP3
- list of commands

Again, try:

$ telnet mail.dcu.ie 110
$ telnet mailhost.computing.dcu.ie 110

Using Telnet with a POP3 Mail Server
Could write script to loop forever, alert you when new message comes in from sender X.

Sample POP3 conversation to retrieve 3 email messages.
You can retrieve and then delete from server. Or retrieve and leave on server.

IMAP

Updated protocol for standalone clients.

IMAP - Multiple clients accessing the same mailbox. Each sees the others' changes.
e.g. Access DCU mail from home and from work. Don't want changes stored on client.
With POP, can "leave messages on server". But no folders. With IMAP, can create mailbox subfolders on the server.
Other features:
- Partial fetch. Just fetch header. Useful for typical modern situation (hundreds of messages, most spam).
- Server-side searches.

Web-based email

Web-based email like Gmail or DCU Webmail

Keep everything on server (like IMAP). No standalone client. Just web browser.

For some uses can be less flexible than standalone client.

Note that webmail systems Yahoo, Hotmail and Gmail can be accessed through either webmail or a standalone client.

Survey of email clients, 2012 shows that mobile has now overtaken desktop for email reading.
Also shows a mix of webmail and standalone email clients.

I use desktop standalone (Mozilla Thunderbird with IMAP).

Survey of email clients, 2013

Email protocol security

This is not relevant to web-based email (where you are authenticated for both sending and receiving).
This is about using a stand-alone mail client to communicate with a mail server through POP3 or IMAP.

You may find:

You are logged on at home through an ISP.
You read your email by talking to DCU mail server.
But you cannot send outgoing email through DCU mail server. You have to send outgoing through your ISP mail server.

Why?

Need password to read a user's mailbox.
But don't need password to send email, because could be just forwarding it in a point-to-point relay. Password can't travel with the email.
Problem is then spammers use DCU open mail relay to send outgoing email.
Solution: Can only send email when within DCU.

Why don't ISPs have this problem?

Because you are already logged into their domain - they have validated you. You are emailing from within their domain.
With DCU, you are logged into the ISP domain and are trying to send through DCU.

Solution:

incoming thru DCU server (with password)
outgoing thru ISP server (already authenticated)

Email filters

My scheme for stopping spam