How an Email Travels from Your Outbox to Someone Else's Inbox

Hit send and your email is already in motion, bouncing between servers, passing security checks, and crossing the internet before the other person's phone buzzes. The whole trip takes a few seconds at most, but the path it follows is surprisingly intricate.

Your Email Client Hands the Message Off

The moment you press send, your email client, whether it is Gmail, Outlook, or a phone app, does not deliver the message itself. It passes the email to your email provider's outgoing mail server using a protocol called SMTP, which stands for Simple Mail Transfer Protocol. Think of SMTP as the postal language servers use to talk to each other. Your client authenticates itself with a username and password, then submits the message to the server's queue. From this point, your device is out of the picture.

The Server Looks Up the Address

Your provider's SMTP server reads the recipient's address, specifically the part after the @ symbol, and needs to find where that domain's mail server lives. It does this by querying the Domain Name System, the internet's directory service, for a specific type of record called an MX record. MX stands for Mail Exchanger. Every domain that receives email publishes one or more MX records pointing to its incoming mail servers. If you are sending to someone at a different provider, your server finds their MX record and connects directly to their server. If both sender and recipient use the same provider, the message stays inside that provider's own infrastructure and the external lookup is skipped.

The Two Servers Shake Hands

Once your provider's server has the destination address, it opens a connection to the recipient's incoming mail server and the two exchange a short formal greeting, a handshake defined by the SMTP standard. During this exchange, the receiving server checks several things. It verifies that your sending server is authorised to send mail for your domain, using authentication records called SPF and DKIM. SPF is a list of servers permitted to send from a domain; DKIM is a cryptographic signature attached to the message that proves it was not altered in transit. A third check called DMARC tells the receiving server what to do if either of those checks fails. These three mechanisms together are the main reason most spoofed or forged emails never reach an inbox.

The Spam Filter Makes Its Decision

Passing authentication is not the same as reaching the inbox. The receiving server hands the message to a spam filtering system, which scores it against dozens of signals: the sending server's reputation, whether the domain has been used to send junk before, the ratio of images to text, whether links in the body point to known bad addresses, and patterns in the subject line and content. A high score sends the message to the spam folder. A very high score causes the server to reject it outright, and your provider sends you a bounce notification. Most legitimate email scores low and moves on.

The Message Lands and Waits

Once the spam filter clears the message, it is written to the recipient's mailbox on the server, a file stored on the provider's infrastructure. The email sits there until the recipient's device asks for it. Modern email apps use a protocol called IMAP, which keeps the mailbox on the server and syncs a copy to the device. When the recipient opens their app, IMAP fetches any new messages. Older systems used POP3, which downloaded messages and removed them from the server; most apps today default to IMAP so the same inbox appears consistently across a phone, a laptop, and a browser tab.

Every step in this chain, the SMTP handshake, the DNS lookup, the authentication checks, the spam score, the IMAP sync, happens in the background in roughly the time it takes to lift your thumb off the screen. When an email goes missing, it has almost always failed at one of these specific points: a misconfigured SPF record, a domain on a spam blacklist, or a receiving server that is temporarily unreachable. The journey is invisible, but the mechanics behind it are precise enough that when something breaks, there is always a specific reason why.