# What is a mail server, and how does it work?

URL: https://iblockspam.com/blog/what-is-a-mail-server
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Email security basics
Author: iBlockSpam Team

> What a mail server is, the difference between incoming and outgoing servers, how one handles a message, how to find yours, and what running your own involves.

## Short answer

A mail server is software, usually on an always-on computer, that sends, receives and stores email for a domain. The outgoing (SMTP) server accepts mail from your app and delivers it to the recipient's server. The incoming server receives mail for your domain, stores it, and lets your app read it over IMAP, POP3 or Exchange protocols.

Every email you send or receive passes through mail servers, even if you've never seen one. When a mail app asks for an "incoming server" and an "outgoing server", or a DNS host asks for an MX record, it's asking about mail servers. This guide explains what a mail server is, what each part does, how to find yours, and what it takes to run one.

## What is a mail server?

A mail server is software, running on an always-on computer, that sends, receives and stores email for one or more domains. It does three jobs: it accepts messages from users and passes them on, it receives messages from other mail servers on the internet, and it keeps delivered messages in mailboxes until people read them.

Those jobs are separate roles, and the IETF's mail architecture document, [RFC 5598](https://www.rfc-editor.org/rfc/rfc5598.html), names each one. One product often plays several roles at once:

| Role | Full name | What it does | Example software |
|---|---|---|---|
| MSA | Mail Submission Agent | Accepts mail from your app after you sign in, usually on port 587 | Postfix submission service, Exchange Front End Transport |
| MTA | Mail Transfer Agent | Relays mail from server to server over SMTP | Postfix, Exim, Sendmail, Exchange Transport |
| MDA | Mail Delivery Agent | Places a received message into the right mailbox | Dovecot LDA or LMTP, Exchange Mailbox Transport Delivery |
| Message store | Message Store | Holds mailboxes and folders | Maildir files, the Exchange mailbox database |
| Access server | (IMAP/POP3 server) | Lets apps read and manage stored mail | Dovecot, Exchange Online |

So "the mail server" is really a small system. On a cPanel host, Exim handles transfer and Dovecot handles mailbox access. In Microsoft 365 or Google Workspace, the provider runs all of it for you. Our guide to the [mail transfer agent (MTA)](https://iblockspam.com/blog/what-is-a-mail-transfer-agent-mta) goes deeper on the transfer role.

## What is the difference between an incoming and an outgoing mail server?

The outgoing mail server sends your mail; the incoming mail server receives and stores mail for you. Mail apps ask for both because they use different protocols.

- **Outgoing (SMTP) server.** Your app hands each new message to this server, which then delivers it to the recipient's domain. [RFC 6409](https://www.rfc-editor.org/rfc/rfc6409.html) calls this step "message submission" and requires you to authenticate. It normally uses port 587 or 465; see [SMTP ports 25, 587 and 465](https://iblockspam.com/blog/smtp-ports-25-587-465).
- **Incoming (IMAP or POP3) server.** Your app reads your mailbox from this server. IMAP keeps everything on the server and in sync; POP3 downloads it. [IMAP vs POP3 vs Exchange](https://iblockspam.com/blog/imap-vs-pop3-vs-exchange) explains which to choose.

Microsoft's documentation makes the split clear: POP3 and IMAP4 "email programs don't use POP3 and IMAP4 to send messages," they "rely on SMTP to send messages." Here are typical settings. The Microsoft 365 values are [Microsoft's published settings](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/pop3-and-imap4/pop3-and-imap4); the third row is an example for a self-hosted domain.

| Setting | Microsoft 365 | Example self-hosted domain |
|---|---|---|
| Incoming server (IMAP) | `outlook.office365.com`, port 993, SSL/TLS | `mail.yourcompany.example`, port 993, SSL/TLS |
| Incoming server (POP3) | `outlook.office365.com`, port 995, SSL/TLS | `mail.yourcompany.example`, port 995, SSL/TLS |
| Outgoing server (SMTP) | `smtp.office365.com`, port 587, STARTTLS | `mail.yourcompany.example`, port 587, STARTTLS |
| Server that receives your domain's mail | Your MX host, e.g. `yourcompany-example.mail.protection.outlook.com` | `mail.yourcompany.example` via your MX record |

There is a third kind of incoming server that apps never ask about: the **inbound MX server**, which receives mail from the rest of the internet for your whole domain. RFC 5598 describes it as "an MTA running on the host listed as the target of an MX record." Your [MX record](https://iblockspam.com/blog/what-is-an-mx-record) tells every sender where it is.

## What happens when a mail server handles a message?

Here is the path of one message from a colleague to a customer:

1. **Submission.** Your app signs in to your outgoing server and submits the message.
2. **Lookup.** Your server looks up the MX records for the recipient's domain. [RFC 5321](https://www.rfc-editor.org/rfc/rfc5321.html) sets the rule that the lowest preference value is tried first.
3. **Transfer.** Your server connects to the recipient's MX host on port 25 and transfers the message over SMTP, usually encrypted with STARTTLS.
4. **Acceptance and filtering.** The recipient's server decides whether to accept the message. It checks SPF, DKIM and DMARC, runs spam and malware filters, and may reject, quarantine or accept it.
5. **Delivery.** The final server places the message in the recipient's mailbox, in the inbox or the junk folder.
6. **Reading.** The recipient's app fetches it over IMAP, POP3 or an Exchange protocol.

If the recipient's server is unavailable at step 3, your server queues the message and tries again. RFC 5321 says "the give-up time generally needs to be at least 4-5 days", which is why a short outage delays mail rather than losing it. [What happens to email when a server is down](https://iblockspam.com/blog/what-happens-to-email-when-server-is-down) covers this in detail.

Every server that accepts the message adds a `Received:` header. Paste a message's headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see each mail server it passed through.

## What are examples of mail servers?

Mail servers come in two broad forms: hosted services that someone else runs, and software you install and run yourself.

| Type | Examples | Who runs it | Typical user |
|---|---|---|---|
| Hosted business email | Microsoft 365 (Exchange Online), Google Workspace, Zoho Mail | The provider | Most small and mid-size businesses |
| Web hosting mail | cPanel & WHM (Exim and Dovecot), Plesk | Your host, sometimes you | Small sites on shared or VPS hosting |
| Self-hosted MTA | Postfix, Exim, Sendmail | You | Technical teams, apps, universities |
| Self-hosted IMAP/POP3 server | Dovecot | You | Paired with Postfix or Exim |
| On-premises groupware | Exchange Server Subscription Edition | You | Organizations that keep mail on site |

[Dovecot's documentation](https://doc.dovecot.org/) describes it as "an open source email server for Linux/UNIX-like systems" that "supports the IMAP (RFC 3501), POP3 (RFC 1939), LMTP (RFC 2033), and ManageSieve (RFC 5228) mail protocols." Microsoft's [Exchange transport pipeline](https://learn.microsoft.com/en-us/exchange/mail-flow/mail-flow) shows how Exchange Server combines several of these roles in one product.

Hosted services dominate business mail. In our [October 2026 scan of the Tranco top 1,000 domains](https://iblockspam.com/research/email-security-top-1000), 693 domains receive mail. By primary MX host name, 233 of the 693 used Google Workspace and 93 used Microsoft 365, while 254 pointed at other or self-hosted servers. That's a heuristic based on host names, and it can't see a provider that sits behind a filtering service's host name, so treat it as a rough picture.

## How do I find my mail server?

You can find your mail servers in three places, depending on which one you need:

1. **The server that receives your domain's mail.** Run an [MX lookup](https://iblockspam.com/tools/mx-lookup) on your domain. The hosts listed are your inbound mail servers. A result like `*.mail.protection.outlook.com` (or `*.mx.microsoft`, which Microsoft's [published endpoint list](https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges) also includes) means Microsoft 365. `smtp.google.com`, or an older value starting with `aspmx` such as `aspmx.l.google.com`, means Google Workspace; Google's [MX setup page](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace) says the legacy values "are still supported."
2. **Your incoming and outgoing server names.** Open your mail app's account settings, or your provider's help pages. Microsoft 365 and Google publish theirs; web hosts usually show them in the control panel's email section.
3. **The server that sent a particular message.** Open the message headers and read the `Received:` lines from the bottom up. [How to read email headers](https://iblockspam.com/blog/how-to-read-email-headers) shows how.

## What DNS records does a mail server need?

A mail server needs DNS records so other servers can find it and trust its mail. Here is an example set for a self-hosted domain. Every value is a placeholder; replace the names, IP address and key with your own.

```
Example DNS records for yourcompany.example (placeholders):

yourcompany.example.          MX    10 mail.yourcompany.example.
mail.yourcompany.example.     A     203.0.113.25
25.113.0.203.in-addr.arpa.    PTR   mail.yourcompany.example.
yourcompany.example.          TXT   "v=spf1 mx -all"
s1._domainkey.yourcompany.example. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc.yourcompany.example.   TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.example"
```

The MX record says where to deliver mail. The A record gives the server's address. The PTR record, set by whoever owns the IP address, maps the address back to the name; see [reverse DNS for mail servers](https://iblockspam.com/blog/reverse-dns-ptr-records-for-mail-servers). SPF, DKIM and DMARC let receivers check that mail claiming to be from your domain is genuine. [Email DNS records explained](https://iblockspam.com/blog/email-dns-records-explained) covers each record, and the [Email Health Check](https://iblockspam.com/tools/email-health-check) checks them in one scan.

## Is a mail server the same as an email provider?

A mail server is the software and machine that handle the mail; an email provider is the company that runs mail servers for you. When you sign up for Microsoft 365 or Google Workspace, you aren't given a server of your own. You get mailboxes on the provider's large, shared mail platform, and the provider tells you which records to publish so the internet delivers your domain's mail there.

The distinction matters when something goes wrong. If mail to your domain bounces, the fault could be in your DNS records, at your provider's servers, or at the sender's server. A provider can fix its own servers, but only you can fix your domain's MX, SPF, DKIM and DMARC records. Knowing which part is yours makes troubleshooting much faster; [why am I not receiving emails](https://iblockspam.com/blog/why-am-i-not-receiving-emails) walks through the checks in order.

## Should you run your own mail server?

Most businesses shouldn't run their own mail server, because a hosted service handles the hard parts for less effort. Running one is possible, but the internet expects a lot from a server that sends mail. Google's [sender guidelines](https://support.google.com/a/answer/81126) require all senders to "ensure that sending domains or IPs have valid forward and reverse DNS records," to "use a TLS connection for transmitting email," and to set up SPF or DKIM.

Before you decide, check that you can meet every item on this list:

- **A static public IP address** with a clean history and a PTR record that you or your provider can set.
- **Outbound port 25 open.** Many ISPs and cloud platforms block it; see [port 25 blocked](https://iblockspam.com/blog/port-25-blocked-cloud-isp).
- **TLS certificates** for SMTP, IMAP and submission, renewed on time.
- **SPF, DKIM and DMARC** published and aligned for every domain.
- **Relay restrictions** so the server never becomes an [open relay](https://iblockspam.com/blog/what-is-an-open-relay).
- **Security updates** applied promptly. Mail server bugs such as [SMTP smuggling](https://iblockspam.com/blog/smtp-smuggling-explained) needed fixes in Postfix, Sendmail and Exim.
- **Spam and malware filtering** for inbound mail, and outbound monitoring so a compromised account doesn't get you blocklisted.
- **Backups, monitoring and a plan for outages**, including a backup route for inbound mail.
- **Someone to read the logs** and handle [blocklist removals](https://iblockspam.com/blog/remove-domain-ip-from-email-blacklist).

| | Hosted (Microsoft 365, Google Workspace) | Self-hosted |
|---|---|---|
| Who patches it | The provider | You |
| Sending reputation | The provider's shared, managed IPs | Your own IP, built from scratch |
| Uptime and backups | The provider's responsibility | Yours |
| Control over data and routing | Limited to the provider's settings | Complete |
| Calendar and collaboration | Included | Needs extra software |

If you still run Exchange Server on premises, note that Exchange Server 2016 and 2019 reached the end of extended support in October 2025. [Exchange Server end of support](https://iblockspam.com/blog/exchange-server-end-of-support-email-options) lays out the options, and [hosted vs on-premise spam filters](https://iblockspam.com/blog/hosted-vs-on-premise-spam-filter) compares the filtering side.

## Where does a spam filter fit with a mail server?

A spam filter can run inside your mail server or as a separate mail server in front of it. Hosted platforms include their own filtering. An MX-level filtering service is itself an inbound mail server: your MX record points to it, it receives mail from the internet, filters it, and relays clean mail to your mailbox server. [How spam filters work](https://iblockspam.com/blog/how-spam-filters-work) walks through the checks, and iBlockSpam's [how it works](https://iblockspam.com/how-it-works) page shows how an MX-level filter sits in front of Microsoft 365, Google Workspace, cPanel or Exchange.

## Next steps

- Run an [MX lookup](https://iblockspam.com/tools/mx-lookup) to see which servers receive mail for your domain.
- Check your MX, SPF, DKIM and DMARC records together with the free [Email Health Check](https://iblockspam.com/tools/email-health-check).
- If you run your own server, check its [reverse DNS](https://iblockspam.com/tools/ptr-lookup) and its IP on the [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker), and test it isn't an open relay.
- If you want inbound filtering and outage queuing in front of your current mail server, compare the plans on our [pricing page](https://iblockspam.com/pricing).

Browse our other [email basics guides](https://iblockspam.com/blog/topic/basics).

## Frequently asked questions

### What is the difference between a mail server and an email client?

The mail server is the always-on system that sends, receives and stores messages for a domain. The email client is the app you read and write mail in, such as Outlook, Apple Mail or the Gmail app. The client connects to the server to fetch mail with IMAP, POP3 or Exchange protocols, and hands outgoing mail to it over SMTP.

### Is Gmail a mail server?

Gmail is a mail service that runs Google's own mail servers. When you use Gmail or Google Workspace, Google operates the incoming and outgoing servers for you, and its MX hosts receive mail for your domain. You connect to them with the Gmail app, a browser, or a mail client using imap.gmail.com and smtp.gmail.com.

### Do I need my own mail server for a business domain?

Usually not. Most small businesses use a hosted service such as Microsoft 365 or Google Workspace, which runs the servers, patches them and handles reputation and uptime. Running your own server makes sense when you need full control of data or routing, and you have someone who can manage DNS, TLS, blocklists and security updates.

### How do I find my incoming and outgoing mail server names?

Look in your mail app's account settings, where the incoming (IMAP or POP3) and outgoing (SMTP) server names are listed, or check your provider's help pages. For the server that receives mail for your whole domain, look up the domain's MX records. They name the hosts that other servers deliver your mail to.

### What happens to email if my mail server is offline?

Sending servers keep the message in their queue and retry. RFC 5321 says retries should usually wait at least 30 minutes and that the give-up time generally needs to be at least four to five days. If your server is back before the sender gives up, the mail arrives late but intact; after that, the sender gets a bounce.

## Sources

- [RFC 5598: Internet Mail Architecture](https://www.rfc-editor.org/rfc/rfc5598.html)
- [RFC 5321: Simple Mail Transfer Protocol](https://www.rfc-editor.org/rfc/rfc5321.html)
- [RFC 6409: Message Submission for Mail](https://www.rfc-editor.org/rfc/rfc6409.html)
- [Microsoft Learn: POP3 and IMAP4 in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/pop3-and-imap4/pop3-and-imap4)
- [Google Workspace Admin Help: Email sender guidelines](https://support.google.com/a/answer/81126)
- [Dovecot CE documentation](https://doc.dovecot.org/)
- [Microsoft Learn: Mail flow and the transport pipeline (Exchange Server)](https://learn.microsoft.com/en-us/exchange/mail-flow/mail-flow)

## Free tools for this guide

- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [Reverse DNS (PTR) Lookup](https://iblockspam.com/tools/ptr-lookup): Check PTR records, forward-confirmed reverse DNS and generic-looking host names.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.

---

Source: iBlockSpam, https://iblockspam.com/blog/what-is-a-mail-server (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt