SMTP Server Commands Explained | Full List, Syntax, and Use Cases

Key takeaways

• EHLO, MAIL FROM, RCPT TO and DATA are the sequence for sending a message.
• SMTP over port 25 is for server to server, and submission usually uses 587.
• Test manually with telnet or openssl in a lab.

Table of Contents

• What Is SMTP?
• How SMTP Communication Works
• What Are the Commonly Used SMTP Server Commands?
• Optional/Extended SMTP Commands (ESMTP)
• SMTP Command Example (Telnet Session)
• Security Risks of SMTP
•  Conclusion

SMTP (Simple Mail Transfer Protocol) is the backbone of sending emails over the internet. Cybersecurity professionals, network administrators and aspiring ethical hackers should understand SMTP server commands to analyse email traffic, test configurations and detect vulnerabilities like email spoofing or phishing.

This post covers what SMTP is, its working mechanism, and a full list of SMTP commands, including their syntax, functions, and examples.

What Is SMTP?

SMTP stands for Simple Mail Transfer Protocol. It's an application-layer protocol used to send and relay emails between mail servers and clients. SMTP works primarily over TCP port 25 (and sometimes 587 or 465 for secure connections).

SMTP doesn’t retrieve or store messages, it only sends them. For receiving emails, protocols like IMAP or POP3 are used.

How SMTP Communication Works

When you send an email, here's what typically happens:

1. Your email client connects to the SMTP server.

2. A handshake is established.

3. The client identifies itself and the sender/recipient.

4. The message is transferred in ASCII format.

5. The connection is terminated.

This entire process is driven by SMTP commands and responses exchanged between the client and server.

What Are the Commonly Used SMTP Server Commands?

Here are the most commonly used SMTP commands, in order of their typical usage:

1. HELO / EHLO

• Purpose: Initiates the SMTP session.

• HELO is used for basic SMTP servers; EHLO is used for servers that support Extended SMTP (ESMTP).

• Syntax:

  HELO yourdomain.com
  

  or

  EHLO yourdomain.com
  

• Response: 250 Hello yourdomain.com

2. MAIL FROM

• Purpose: Specifies the sender's email address.

• Syntax:

  MAIL FROM:
  

• Response: 250 OK

3. RCPT TO

• Purpose: Identifies the recipient's email address.

• Syntax:

  RCPT TO:
  

• Response: 250 OK (or error if address is not valid)

4. DATA

• Purpose: Begins the message body transfer.

• Syntax:

  DATA
  

  After this command, the server responds with:

  354 End data with .
  

  You then write the email content and end with a single period on a line:

  This is the message body.
  

5. RSET

• Purpose: Resets the current mail session (clears all previous commands).

• Syntax:

  RSET
  

• Response: 250 OK

6. NOOP

• Purpose: Sends a "no operation" command. It does nothing but ensures the server is responsive.

• Syntax:

  NOOP
  

• Response: 250 OK

7. VRFY

• Purpose: Verifies whether an email address exists on the server.

• Syntax:

  VRFY [email protected]
  

• Response: Could return 250, 252, or 550 depending on the server configuration.

 Many modern servers disable this command for security reasons.

8. EXPN

• Purpose: Expands a mailing list to reveal all recipients.

• Syntax:

  EXPN listname
  

• Response: Lists recipients or returns an error.

 Like VRFY, often disabled for privacy/security.

9. HELP

• Purpose: Requests a list of available commands.

• Syntax:

  HELP
  

• Response: List of SMTP commands and descriptions.

10. QUIT

• Purpose: Ends the SMTP session and disconnects.

• Syntax:

  QUIT
  

• Response: 221 Bye

Optional/Extended SMTP Commands (ESMTP)

When using EHLO, servers may support additional ESMTP extensions, such as:

STARTTLS

• Purpose: Upgrades connection to a secure TLS/SSL.

• Syntax:

  STARTTLS
  

AUTH

• Purpose: Authenticates the client using login credentials.

• Syntax:

  AUTH LOGIN
  

SMTP Command Example (Telnet Session)

Here's how a basic email session might look via Telnet:

telnet smtp.example.com 25

220 smtp.example.com ESMTP
EHLO test.com
250-smtp.example.com Hello
MAIL FROM:
250 OK
RCPT TO:
250 OK
DATA
354 End data with .
Subject: Test Email

This is a test.
.
250 OK: queued
QUIT
221 Bye

Security Risks of SMTP

SMTP by default is not encrypted, which exposes it to:

• Man-in-the-middle attacks

• Email spoofing

• SMTP relay abuse

• Phishing

Mitigations Include:

• Enabling TLS encryption (STARTTLS)

• Enforcing SMTP Authentication (AUTH)

• Implementing SPF, DKIM, and DMARC

Conclusion

SMTP commands form the core of how email is transmitted across networks. Understanding these commands helps you troubleshoot and configure mail servers, and it is also used in cybersecurity and penetration testing. From sending emails using Telnet to detecting SMTP misconfigurations, this knowledge is useful in both offensive and defensive security.

To take this further with guided labs and an instructor, see our practical networking labs.

Related reading

• What Are TCP Communication Flags? A Complete Guide to TCP Header Flags (SYN, ACK, FIN, RST, PSH, URG) With Real-Time Examples and Header Structure
• Top 6 Server Types You Must Know in 2026 for IT and Cybersecurity | The Detailed Guide
• What Is the Opossum Attack? Understanding TLS Desynchronization Vulnerabilities That Let Hackers Inject Data into Secure Channels

Reference

For the authoritative details, see IETF RFCs.