# How are email servers located using SMTP? **URL:** \ **Category:** Factual Questions\ **Created:** [August 31, 2005, 3:06pm UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433 "2005-08-31T15:06:54Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Just](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@Just](https://boards.straightdope.com/u/Just)\ **Post date:** [August 31, 2005, 3:06pm UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/1 "2005-08-31T15:06:54Z")
I was a little bit curious about the inner workings of SMTP, but googling it reveals a lot of information on the protocol itself. Email client uses SMTP to talk to email server, which talks directly to another email server to deliver the message. Person receiving the email uses POP or IMAP or some other protocol to receive the email. The details of the SMTP protocol (commands, packet structure, etc) are easy to find, but what no online site seems to mention is how the email server finds another email server to send the email to. For example, if [jim@yahoo.com](mailto:jim@yahoo.com) wants to email [tom@hotmail.com](mailto:tom@hotmail.com), how does yahoo’s email server locate the hotmail server? Is it just done the same way as for web pages? yahoo’s email server uses a DNS server to convert [hotmail.com](http://hotmail.com) to an IP address, and then makes a TCP connection to that IP address on port 25? Thanks, Just ---
**Author:** ![Crescend](https://avatars.discourse-cdn.com/v4/letter/c/b9bd4f/32.png) [@Crescend](https://boards.straightdope.com/u/Crescend)\ **Post date:** [August 31, 2005, 3:10pm UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/2 "2005-08-31T15:10:45Z")
Pretty much. What happens when you want to send an email to, say, [joe@example.org](mailto:joe@example.org), is that the SMTP server looks up [example.org](http://example.org) in DNS, and requests its “MX” (Mail Exchanger) record. That returns the address of the mail server responsible for [example.org](http://example.org). It then contacts that mail server and tells it that it has a message for Joe. ---
**Author:** ![Just](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@Just](https://boards.straightdope.com/u/Just)\ **Post date:** [August 31, 2005, 3:20pm UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/3 "2005-08-31T15:20:01Z")
> [@Crescend](#): > > Pretty much. What happens when you want to send an email to, say, [joe@example.org](mailto:joe@example.org), is that the SMTP server looks up [example.org](http://example.org) in DNS, and requests its “MX” (Mail Exchanger) record. That returns the address of the mail server responsible for [example.org](http://example.org). It then contacts that mail server and tells it that it has a message for Joe. Thanks **Crescend**. I guess that answers my next question - what if the [hotmail.com](http://hotmail.com) web server has a different IP address to the [hotmail.com](http://hotmail.com) email server? So the DNS server has different records for email and web servers. Is there a list of types of records that DNS can have (email and web I’m assuming are only two of many)? ---
**Author:** ![friedo](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@friedo](https://boards.straightdope.com/u/friedo)\ **Post date:** [August 31, 2005, 3:26pm UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/4 "2005-08-31T15:26:10Z")
[Types of DNS records](http://en.wikipedia.org/wiki/DNS#Types_of_DNS_records). DNS is a real bitch. ---
**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\ **Post date:** [August 31, 2005, 3:34pm UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/5 "2005-08-31T15:34:04Z")
> [@just](#): > > . . .makes a TCP connection to that IP address on port 25? In addition to the above info which is good & valuable. I would just add that you can play with this by opening a telnet session to that IP address on port 25 and become a human SMTP client. ---
**Author:** ![Just](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@Just](https://boards.straightdope.com/u/Just)\ **Post date:** [September 1, 2005, 4:45am UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/6 "2005-09-01T04:45:43Z")
Thanks for the replies… > [@CookingWithGas](#): > > In addition to the above info which is good & valuable. I would just add that you can play with this by opening a telnet session to that IP address on port 25 and become a human SMTP client. Oooh, that sounds like fun. I have a gmail email address, for example: can I just go “telnet [gmail.com](http://gmail.com) 25” and start typing in SMTP commands and an email? Is using telnet in this way identical to opening a regular TCP socket? _Opens command prompt to try it_ C:\Documents and Settings\Just\>telnet [gmail.com](http://gmail.com) 25 Connecting To [gmail.com](http://gmail.com)…Could not open connection to the host, on port 25: Connect failed Damn, that doesn’t work. My firewall prompted me a few times to allow the outgoing connection (I hit ‘yes’ everytime), and then it seemed to attempt to connect for a few seconds, before I get the “connect failed” error. I’m guessing it’d probably be better for me to set up my own email server to learn how this works, but I’m still curious: why does the connection fail? How does gmail know I’m not an actual email server? ---
**Author:** ![friedo](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@friedo](https://boards.straightdope.com/u/friedo)\ **Post date:** [September 1, 2005, 5:03am UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/7 "2005-09-01T05:03:36Z")
Remember that MX records are separate from regular DNS records. To talk to [gmail.com](http://gmail.com)’s SMTP server, you need to first look up the MX record for [gmail.com](http://gmail.com): ```auto $ host -t mx gmail.com gmail.com mail is handled by 5 gmail-smtp-in.l.google.com. gmail.com mail is handled by 10 gsmtp163.google.com. gmail.com mail is handled by 10 gsmtp171.google.com. gmail.com mail is handled by 10 gsmtp185.google.com. gmail.com mail is handled by 10 gsmtp171-2.google.com. gmail.com mail is handled by 10 gsmtp185-2.google.com. ``` Those are (some of) the gmail SMTP servers - you can telnet to any of them on port 25 and send yourself (or anyone else on gmail) a message. ---
**Author:** ![Just](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@Just](https://boards.straightdope.com/u/Just)\ **Post date:** [September 1, 2005, 5:31am UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/8 "2005-09-01T05:31:35Z")
Cool, I just sent myself an email to my gmail account. 🙂 Thanks **friedo**. On Windows, I discovered I could get the same output as you did using the host command by going “nslookup -querytype=mx [gmail.com](http://gmail.com)”. Then I telnetted to port 25 on the first of these in the list, and sent myself an email. 🙂 The only weird behaviour I noticed was that gmail wouldn’t accept some of my commands the first time, but would on the second. For example, I went “RCPT TO: \<[myemailaddress@gmail.com](mailto:myemailaddress@gmail.com)\>”, and it responded with “550 5.7.1 No such user 12si191267nzn” on the first attempt and “502 5.5.1 Unrecognized command 12si191267nzn” on the second attempt. On the third attempt, it worked fine. I also noticed that my email wasn’t sent quite the same way I typed it (eg I tried to make the subject of the email “Testing SMTP”, but it actually came out as “Testing SMPTY” followed by a few garbage characters). Any ideas why? I suspect it’s Windows’ telnet client, which I’ve found to be pretty lousy in the past. Or are there any more likely explanations? ---
**Author:** ![friedo](https://avatars.discourse-cdn.com/v4/letter/f/8edcca/32.png) [@friedo](https://boards.straightdope.com/u/friedo)\ **Post date:** [September 1, 2005, 5:16pm UTC](https://boards.straightdope.com/t/how-are-email-servers-located-using-smtp/319433/9 "2005-09-01T17:16:58Z")
I just tried one of the gmail SMTP servers with linux telnet and it worked fine for sending to my gmail account. I’m guessing it’s an issue with Windows telnet. (Probably sending weird carriage returns or something. Windows is like that.)