E-mail: how it works, where it comes from, where it is going

More than 50 years old and still the most important tool in business: how an e-mail finds its way, why forgery used to be so easy and what is changing right now.

An e-mail is a letter in an envelope

An e-mail works much like a letter. There is an envelope with sender and recipient, which the post office needs for delivery, and a letter inside with letterhead, subject and text. The special thing: with e-mail, anyone can write whatever they like on the envelope and in the letterhead. We will come back to that in a moment.

The journey of an e-mail

Diagram: Anna sends the e-mail via SMTP to her mail server, which looks up the recipient's mail server in the DNS (MX) and delivers via SMTP; Ben collects it via IMAP. Along the way the recipient checks SPF, DKIM and DMARC. — From Anna (A) to Ben (B): three stages, three protocols.

Sending: Anna's mail program hands the message to her company's mail server. This happens with the SMTP protocol, using a user name and password.
Passing on: Anna's mail server looks up in the phone book of the internet, the DNS, which server is responsible for Ben's domain (the "MX record"). It then hands the message to that server, again using SMTP.
Collecting: Ben reads the message with his mail program or phone. It fetches it from the server with IMAP and leaves it there so that all devices show the same state.

Like the post: post box (sending), sorting centre with address book (passing on) and P.O. box at the counter (collecting).

A short history

Timeline of e-mail from 1971 (first e-mail on the ARPANET with @) to 2026 (DMARCbis) — From the first message with @ to today's rules against forgery.

1971 On the ARPANET, the forerunner of the internet, Ray Tomlinson sends messages between two computers and chooses the @ sign for "at".
1982 SMTP is defined, the language mail servers still use to talk to each other today.
1984–88 POP and IMAP appear: you no longer have to sit at the server to read your mail.
1992–96 MIME makes it possible to send attachments, pictures and accented characters.
1990s E-mail becomes a mass medium – and a tool for spam and fraud.
from 2000 Encryption between servers (STARTTLS) and authenticity checks (SPF, DKIM, DMARC) are added.
2024–25 Google, Yahoo and Microsoft require SPF, DKIM and DMARC from bulk senders – otherwise e-mails are rejected.
2026 The revised DMARC rule (DMARCbis) is published as a new internet standard.

Why e-mails were so easy to forge

SMTP comes from a time when everyone on the network knew each other. Nobody checked whether "From: boss@company.ch" was true. Fraudsters still exploit this today: fake invoices, alleged messages from the boss ("please transfer quickly") or links to copied login pages.

The three seals: SPF, DKIM and DMARC

Envelope with three seals: SPF checks the sending server, DKIM the digital signature, DMARC defines what happens with forgeries — Three DNS records make an e-mail verifiable.

SPF is the list of postmen: which servers may send e-mails for my domain?
DKIM is the signature: the server signs every e-mail digitally. If it is changed on the way, the signature no longer matches.
DMARC is the instruction to recipients: what should happen to e-mails that claim to come from my domain but fail the check – only report, move to spam or reject?

Only with DMARC set to "reject" (p=reject) is a domain effectively protected against forgery. Many companies stop halfway.

E-mail today

Well over 300 billion e-mails are sent worldwide every day; a large share of them is spam.
Most companies use large providers (e.g. Microsoft 365, Google Workspace) or a mail server at their hosting provider.
Traffic between servers is almost always encrypted. On the servers, however, the message is usually stored readably. Confidential content additionally needs end-to-end encryption (S/MIME or OpenPGP) or a secure portal.
Phishing by e-mail remains one of the most common ways attacks on companies begin.

What is coming

Stricter rules: large mailbox providers increasingly reject unprotected e-mails. Without SPF, DKIM and DMARC, invoices and newsletters no longer arrive.
Encryption becomes mandatory: MTA-STS and DANE can enforce that e-mails are only delivered encrypted.
Quantum-safe methods: encryption on the internet is gradually being switched to methods that future quantum computers cannot break. This also affects mail servers.
Recognisable senders: with BIMI, mailboxes show the logo of verified senders – only those who have fully implemented DMARC get it.
Artificial intelligence helps to detect fraud – and helps fraudsters write more convincing e-mails. Technical authenticity checks therefore become more important, not less.

What you can do

Set up SPF, DKIM and DMARC for all domains, including those that send no e-mail at all (there: reject everything).
Evaluate DMARC reports and move step by step to p=reject.
Train staff: always confirm changes to payment details by phone.
Have your own domain checked regularly from the outside.

In short

E-mail travels in three stages: sending (SMTP), passing on between servers (SMTP via the MX record) and collecting (IMAP).
Senders can be forged because SMTP does not check them.
SPF, DKIM and DMARC make e-mails verifiable; only p=reject protects effectively.
Since 2024/2025, Google, Yahoo and Microsoft require these records; in 2026 DMARCbis is published as the new standard.
MTA-STS and DANE enforce encrypted delivery.