Email Security

Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic (digital) version of, or counterpart to, mail, at a time when "mail" meant only physical mail (hence '' e- + mail''). Email later became a ubiquitous (very widely used) communication medium, to the point that in current use, an email address is often treated as a basic and necessary part of many processes in business, commerce, government, education, entertainment, and other spheres of daily life in most countries.

''Email'' is the medium, and each message sent therewith is also called an ''email.'' The term is a mass noun.

Email operates across computer networks, primarily the Internet, and also local area networks. Today's email systems are based on a store-and-forward model. Email servers accept, forward, deliver, and store messages. Neither the users nor their computers are required to be online simultaneously; they need to connect, typically to a mail server or a webmail interface to send or receive messages or download it.

Originally an ASCII text-only communications medium, Internet email was extended by Multipurpose Internet Mail Extensions (MIME) to carry text in other character sets and multimedia content attachments. International email, with internationalized email addresses using UTF-8, is standardized but not widely adopted.

Terminology

The term ''electronic mail'' has been in use with its modern meaning since 1975, and variations of the shorter ''E-mail'' have been in use since 1979:

* ''email'' is now the common form, and recommended by style guides. It is the form required by IETF Requests for Comments (RFC) and working groups. This spelling also appears in most dictionaries.Random House Unabridged Dictionary, 2006The American Heritage Dictionary of the English Language, Fourth EditionPrinceton University WordNet 3.0The American Heritage Science Dictionary, 2002
* ''e-mail'' is the form favored in edited published American English and British English writing as reflected in the Corpus of Contemporary American English data, but is falling out of favor in some style guides.
* ''E-mail'' is sometimes used. The original usage in June 1979 occurred in the journal ''Electronics'' in reference to the United States Postal Service initiative called E-COM, which was developed in the late 1970s and operated in the early 1980s.
* ''Email'' is also used.
* ''EMAIL'' was used by CompuServe starting in April 1981, which popularized the term.
* ''EMail'' is a traditional form used in RFCs for the "Author's Address".

The service is often simply referred to as ''mail'', and a single piece of electronic mail is called a ''message''. The conventions for fields within emails — the “To,” “From,” “CC,” “BCC” etc. — began with RFC-680 in 1975.

An Internet email consists of an ''envelope'' and ''content''; the content consists of a ''header'' and a ''body''.

History

Computer-based messaging between users of the same system became possible after the advent of time-sharing in the early 1960s, with a notable implementation by MIT's CTSS project in 1965. Most developers of early mainframes and minicomputers developed similar, but generally incompatible, mail applications. In 1971 the first ARPANET network mail was sent, introducing the now-familiar address syntax with the '@' symbol designating the user's system address. Over a series of RFCs, conventions were refined for sending mail messages over the File Transfer Protocol.

Proprietary electronic mail systems soon began to emerge. IBM, CompuServe and Xerox used in-house mail systems in the 1970s; CompuServe sold a commercial intraoffice mail product from 1978 and IBM and Xerox from 1981.; ; ; ; DEC's ALL-IN-1 and Hewlett-Packard's HPMAIL (later HP DeskManager) were released in 1982; development work on the former began in the late 1970s and the latter became the world’s largest selling email system.

The Simple Mail Transfer Protocol (SMTP) protocol was implemented on the ARPANET in 1983. LAN email systems emerged in the mid 1980s. For a time in the late 1980s and early 1990s, it seemed likely that either a proprietary commercial system or the X.400 email system, part of the Government Open Systems Interconnection Profile (GOSIP), would predominate. However, once the final restrictions on carrying commercial traffic over the Internet ended in 1995, a combination of factors made the current Internet suite of SMTP, POP3 and IMAP email protocols the standard (see Protocol Wars).

Operation

The following is a typical sequence of events that takes place when sender Alice transmits a message using a mail user agent (MUA) addressed to the email address of the recipient.

# The MUA formats the message in email format and uses the submission protocol, a profile of the Simple Mail Transfer Protocol (SMTP), to send the message content to the local mail submission agent (MSA), in this case ''smtp.a.org''.
# The MSA determines the destination address provided in the SMTP protocol (not from the message header) — in this case, ''[e-mail]'' — which is a fully qualified domain address (FQDA). The part before the @ sign is the ''local part'' of the address, often the username of the recipient, and the part after the @ sign is a domain name. The MSA resolves a domain name to determine the fully qualified domain name of the mail server in the Domain Name System (DNS).
# The DNS server for the domain ''b.org'' (''ns.b.org'') responds with any MX records listing the mail exchange servers for that domain, in this case ''mx.b.org'', a message transfer agent (MTA) server run by the recipient's ISP.
# smtp.a.org sends the message to mx.b.org using SMTP. This server may need to forward the message to other MTAs before the message reaches the final message delivery agent (MDA).
# The MDA delivers it to the mailbox of user ''bob''.
# Bob's MUA picks up the message using either the Post Office Protocol (POP3) or the Internet Message Access Protocol (IMAP).

In addition to this example, alternatives and complications exist in the email system:
* Alice or Bob may use a client connected to a corporate email system, such as IBM Lotus Notes or Microsoft Exchange. These systems often have their own internal email format and their clients typically communicate with the email server using a vendor-specific, proprietary protocol. The server sends or receives email via the Internet through the product's Internet mail gateway which also does any necessary reformatting. If Alice and Bob work for the same company, the entire transaction may happen completely within a single corporate email system.
* Alice may not have an MUA on her computer but instead may connect to a webmail service.
* Alice's computer may run its own MTA, so avoiding the transfer at step 1.
* Bob may pick up his email in many ways, for example logging into mx.b.org and reading it directly, or by using a webmail service.
* Domains usually have several mail exchange servers so that they can continue to accept mail even if the primary is not available.

Many MTAs used to accept messages for any recipient on the Internet and do their best to deliver them. Such MTAs are called ''open mail relays''. This was very important in the early days of the Internet when network connections were unreliable. However, this mechanism proved to be exploitable by originators of unsolicited bulk email and as a consequence open mail relays have become rare, and many MTAs do not accept messages from open mail relays.

Message format

The basic Internet message format used for email is defined by , with encoding of non-ASCII data and multimedia content attachments defined in RFC 2045 through RFC 2049, collectively called ''Multipurpose Internet Mail Extensions'' or ''MIME''. The extensions in International email apply only to email. RFC 5322 replaced the earlier RFC 2822 in 2008, then RFC 2822 in 2001 replaced RFC 822 – the standard for Internet email for decades. Published in 1982, RFC 822 was based on the earlier RFC 733 for the ARPANET.

Internet email messages consist of two sections, "header" and "body". These are known as "content". The header is structured into fields such as From, To, CC, Subject, Date, and other information about the email. In the process of transporting email messages between systems, SMTP communicates delivery parameters and information using message header fields. The body contains the message, as unstructured text, sometimes containing a signature block at the end. The header is separated from the body by a blank line.

Message header

RFC 5322 specifies the syntax of the email header. Each email message has a header (the "header section" of the message, according to the specification), comprising a number of fields ("header fields"). Each field has a name ("field name" or "header field name"), followed by the separator character ":", and a value ("field body" or "header field body").

Each field name begins in the first character of a new line in the header section, and begins with a non- whitespace printable character. It ends with the separator character ":". The separator is followed by the field value (the "field body"). The value can continue onto subsequent lines if those lines have space or tab as their first character. Field names and, without SMTPUTF8, field bodies are restricted to 7-bit ASCII characters. Some non-ASCII values may be represented using MIME encoded words.

Header fields

Email header fields can be multi-line, with each line recommended to be no more than 78 characters, although the limit is 998 characters. Header fields defined by RFC 5322 contain only US-ASCII characters; for encoding characters in other sets, a syntax specified in RFC 2047 may be used. In some examples, the IETF EAI working group defines some standards track extensions, replacing previous experimental extensions so UTF-8 encoded Unicode characters may be used within the header. In particular, this allows email addresses to use non-ASCII characters. Such addresses are supported by Google and Microsoft products, and promoted by some government agents.

The message header must include at least the following fields:
* ''From'': The email address, and, optionally, the name of the author(s). Some email clients are changeable through account settings.
* ''Date'': The local time and date the message was written. Like the ''From:'' field, many email clients fill this in automatically before sending. The recipient's client may display the time in the format and time zone local to them.

RFC 3864 describes registration procedures for message header fields at the IANA; it provides fo
permanent
an

field names, including also fields defined for MIME, netnews, and HTTP, and referencing relevant RFCs. Common header fields for email include:

* ''To'': The email address(es), and optionally name(s) of the message's recipient(s). Indicates primary recipients (multiple allowed), for secondary recipients see Cc: and Bcc: below.
* ''Subject'': A brief summary of the topic of the message. Certain abbreviations are commonly used in the subject, including "RE:" and "FW:".
* ''Cc'': Carbon copy; Many email clients mark email in one's inbox differently depending on whether they are in the To: or Cc: list.
* ''Bcc'': Blind carbon copy; addresses are usually only specified during SMTP delivery, and not usually listed in the message header.
* Content-Type: Information about how the message is to be displayed, usually a MIME type.
* ''Precedence'': commonly with values "bulk", "junk", or "list"; used to indicate automated "vacation" or "out of office" responses should not be returned for this mail, e.g. to prevent vacation notices from sent to all other subscribers of a mailing list. Sendmail uses this field to affect prioritization of queued email, with "Precedence: special-delivery" messages delivered sooner. With modern high-bandwidth networks, delivery priority is less of an issue than it was. Microsoft Exchange respects a fine-grained automatic response suppression mechanism, the ''X-Auto-Response-Suppress'' field.
* ''Message-ID'': Also an automatic-generated field to prevent multiple deliveries and for reference in In-Reply-To: (see below).
* ''In-Reply-To'': Message-ID of the message this is a reply to. Used to link related messages together. This field only applies to reply messages.
* ''References'': Message-ID of the message this is a reply to, and the message-id of the message the previous reply was a reply to, etc.
* ': Address should be used to reply to the message.
* ''Sender'': Address of the sender acting on behalf of the author listed in the From: field (secretary, list manager, etc.).
* ''Archived-At'': A direct link to the archived form of an individual email message.

The ''To:'' field may be unrelated to the addresses to which the message is delivered. The delivery list is supplied separately to the transport protocol, SMTP, which may be extracted from the header content. The "To:" field is similar to the addressing at the top of a conventional letter delivered according to the address on the outer envelope. In the same way, the "From:" field may not be the sender. Some mail servers apply email authentication systems to messages relayed. Data pertaining to the server's activity is also part of the header, as defined below.

SMTP defines the ''trace information'' of a message saved in the header using the following two fields:
* ''Received'': after an SMTP server accepts a message, it inserts this trace record at the top of the header (last to first).
* ''Return-Path'': after the delivery SMTP server makes the ''final delivery'' of a message, it inserts this field at the top of the header.

Other fields added on top of the header by the receiving server may be called ''trace fields''.
* ''Authentication-Results'': after a server verifies authentication, it can save the results in this field for consumption by downstream agents.
* ''Received-SPF'': stores results of SPF checks in more detail than Authentication-Results.
* ''DKIM-Signature'': stores results of DomainKeys Identified Mail (DKIM) decryption to verify the message was not changed after it was sent.
* ''Auto-Submitted'': is used to mark automatic-generated messages.
* ''VBR-Info'': claims VBR whitelisting

Message body

Content encoding

Internet email was designed for 7-bit ASCII. Most email software is 8-bit clean, but must assume it will communicate with 7-bit servers and mail readers. The MIME standard introduced character set specifiers and two content transfer encodings to enable transmission of non-ASCII data: quoted printable for mostly 7-bit content with a few characters outside that range and base64 for arbitrary binary data. The 8BITMIME and BINARY extensions were introduced to allow transmission of mail without the need for these encodings, but many mail transport agents may not support them. In some countries, e-mail software violates by sending rawNot using Internationalized Email or MIME non-ASCII text and several encoding schemes co-exist; as a result, by default, the message in a non-Latin alphabet language appears in non-readable form (the only exception is a coincidence if the sender and receiver use the same encoding scheme). Therefore, for international character sets, Unicode is growing in popularity.

Plain text and HTML

Most modern graphic email clients allow the use of either plain text or HTML for the message body at the option of the user. HTML email messages often include an automatic-generated plain text copy for compatibility.

Advantages of HTML include the ability to include in-line links and images, set apart previous messages in block quotes, wrap naturally on any display, use emphasis such as underlines and italics, and change font styles. Disadvantages include the increased size of the email, privacy concerns about web bugs, abuse of HTML email as a vector for phishing attacks and the spread of malicious software.
Some e-mail clients interpret the body as HTML even in the absence of a Content-Type: html header field; this may cause various problems.

Some web-based mailing lists recommend all posts be made in plain text, with 72 or 80 characters per line for all the above reasons, and because they have a significant number of readers using text-based email clients such as Mutt.
Various informal conventions evolved for marking up plain text in email and usenet posts, which later led to the development of formal languages like setext ''(c. 1992)'' and many others, the most popular of them being markdown.

Some Microsoft email clients may allow rich formatting using their proprietary Rich Text Format (RTF), but this should be avoided unless the recipient is guaranteed to have a compatible email client.

Servers and client applications

Messages are exchanged between hosts using the Simple Mail Transfer Protocol with software programs called mail transfer agents (MTAs); and delivered to a mail store by programs called mail delivery agents (MDAs, also sometimes called local delivery agents, LDAs). Accepting a message obliges an MTA to deliver it, and when a message cannot be delivered, that MTA must send a bounce message back to the sender, indicating the problem.

Users can retrieve their messages from servers using standard protocols such as POP or IMAP, or, as is more likely in a large corporate environment, with a proprietary

HOME


Content is Copyleft
Website design, code, and AI is Copyrighted (c) 2014-2017 by Stephen Payne


Consider donating to Wikimedia



As an Amazon Associate I earn from qualifying purchases