Email Basics & Common Threats

Overview

Email (Electronic Mail) is one of the most fundamental and widely used communication tools on the internet. It was invented in the early 1970s and has evolved into a global communication system handling over 350 billion messages per day. However, due to its popularity and open nature, it is also one of the most attacked vectors in cybersecurity. This tutorial covers the basics of how email works and the common threats that target email users.

Table of Contents

Part 1: Email Basics

• 1.1 What is Email?
• 1.2 Key Components of Email Infrastructure
• 1.3 How Email Works — Detailed Flow
• 1.4 Email Header vs Body — Deep Dive
• 1.5 Email Protocols — Detailed Comparison
• 1.6 MIME — Multipurpose Internet Mail Extensions

Part 2: Email Threats — Comprehensive Coverage

• 2.1 What are Email Threats?
• 2.2 Categories of Email Threats
• 2.3 Email Threat Statistics

Part 3: Spam — In-Depth Coverage

• 3.1 What is Spam?
• 3.2 Types of Spam
• 3.3 Real-World Spam Case Study: The "Nigerian Prince" Scam
• 3.4 How Spammers Get Your Email Address
• 3.5 How to Identify Spam — Advanced Checklist
• 3.6 Spam Filtering Technologies — How They Work
• 3.7 Spam Laws and Regulations
• 3.8 How to Protect Yourself from Spam — Complete Guide

Part 1: Email Basics

1.1 What is Email?

Email is a method of exchanging digital messages between people using electronic devices. It was invented by Ray Tomlinson in 1971 when he sent the first email message (QWERTYUIOP) between two computers sitting next to each other. The @ symbol was chosen to separate the user's name from the machine's name — a convention still used today.

Today, email serves multiple purposes:

• Personal Communication — Staying in touch with friends and family
• Professional Communication — Business correspondence, proposals, contracts
• Marketing — Promotional emails, newsletters, offers
• Authentication — Password resets, account verification, 2FA codes
• Notifications — Bank alerts, social media updates, shipping confirmations

1.2 Key Components of Email Infrastructure

1.3 How Email Works — Detailed Flow

When you send an email, it goes through multiple hops across the internet:

Sender's MUA → Sender's MTA (SMTP) → Internet → Recipient's MTA → Recipient's MDA → Recipient's MUA (POP3/IMAP)

Step-by-step breakdown:

Step 1:  You compose an email in Outlook/Gmail and click Send
         ↓
Step 2:  Your mail client connects to an SMTP server (port 587 or 465)
         ↓
Step 3:  SMTP server performs DNS lookup — queries MX (Mail Exchange) record
         for the recipient's domain (e.g., gmail.com → gmail-smtp-in.l.google.com)
         ↓
Step 4:  SMTP server routes the email across the internet, possibly through
         multiple intermediate MTA hops
         ↓
Step 5:  Recipient's MTA receives the email, checks SPF/DKIM/DMARC, scans
         for spam/malware
         ↓
Step 6:  Email is delivered to the recipient's MDA (mailbox storage)
         ↓
Step 7:  Recipient opens their mail client → client uses IMAP (syncs) or
         POP3 (downloads) to fetch the email from the MDA

1.4 Email Header vs Body — Deep Dive

Every email has two main parts:

Email Header

The header contains metadata about the message. This is critical for forensic investigation when analyzing suspicious emails.

Email Body

The actual content of the message. It can be:

• Plain text — Simple text with no formatting
• HTML — Rich text with images, fonts, colors, and embedded links
• Multipart/MIME — Contains both plain text and HTML versions, plus attachments

Security Tip: When investigating a suspicious email, always view the full headers (called "Show Original" in Gmail, "Message Source" in Outlook). The headers reveal whether SPF/DKIM/DMARC passed, the actual originating IP, and the real path the email took.

1.5 Email Protocols — Detailed Comparison

SMTP — Simple Mail Transfer Protocol

SMTP is the protocol for sending emails. It was defined in RFC 821 (1982) and later updated in RFC 5321.

SMTP Commands:
  HELO/EHLO  → Identify the sending server
  MAIL FROM  → Specify the sender (envelope from)
  RCPT TO    → Specify the recipient
  DATA       → Begin message content
  QUIT       → End the session

SMTP Ports:
  Port 25   → Default SMTP (often blocked by ISPs to prevent spam)
  Port 587  → SMTP Submission (requires authentication — recommended)
  Port 465  → SMTPS (SMTP over SSL — deprecated but still used)
  Port 2525 → Alternative SMTP (used by some providers)

POP3 — Post Office Protocol 3

POP3 is used to receive emails by downloading them from the server to the client.

Key Characteristics:
  ✅ Downloads emails to your device
  ✅ By default, deletes emails from server after download
  ✅ Works offline — emails are stored locally
  ❌ Changes on one device don't sync to others
  ❌ If device is lost, emails are gone (unless backed up)
  
POP3 Commands:
  USER  → Send username
  PASS  → Send password
  STAT  → Get mailbox status (number of messages, total size)
  LIST  → List messages
  RETR  → Retrieve a specific message
  DELE  → Mark a message for deletion
  QUIT  → End session and apply changes

Best for: Single-device users who want offline access

IMAP — Internet Message Access Protocol

IMAP is used to receive emails by syncing with the server. Emails stay on the server.

Key Characteristics:
  ✅ Emails stay on the server
  ✅ Changes sync across all devices
  ✅ Partial fetch — can read headers before downloading full email
  ✅ Server-side folders and search
  ❌ Requires internet connection to access emails
  ❌ Uses more server storage
  
IMAP Commands:
  LOGIN        → Authenticate user
  SELECT       → Select a mailbox/folder
  FETCH        → Retrieve message data (headers, body, attachments)
  SEARCH       → Search messages on the server
  STORE        → Change message flags (read, deleted, flagged)
  EXPUNGE      → Permanently remove deleted messages
  LOGOUT       → End session

Best for: Multi-device users (phone, laptop, desktop)

1.6 MIME — Multipurpose Internet Mail Extensions

MIME extends email to support:

• Non-ASCII characters — International languages, emojis 😊
• Attachments — Images, documents, videos, executables
• Rich Text / HTML — Formatted text, colors, fonts
• Multiple parts — Same email with both plain text and HTML versions

MIME Header Example:
  MIME-Version: 1.0
  Content-Type: multipart/mixed; boundary="boundary123"
  Content-Transfer-Encoding: base64

Structure:
  ┌──────────────────────────────────┐
  │  Multipart/Mixed                  │
  │  ├── Text/Plain (simple message)  │
  │  ├── Text/HTML (formatted message)│
  │  └── Application/PDF (attachment) │
  └──────────────────────────────────┘

Part 2: Email Threats — Comprehensive Coverage

2.1 What are Email Threats?

Email threats are malicious activities that use email as the primary attack vector to compromise users, steal data, spread malware, or commit fraud. According to Verizon's 2024 Data Breach Investigations Report, over 94% of malware is delivered via email, and email is the primary vector in 36% of all data breaches.

2.2 Categories of Email Threats

1️⃣ Malware via Email

2️⃣ Social Engineering Threats

3️⃣ Technical Threats

2.3 Email Threat Statistics

Part 3: Spam — In-Depth Coverage

3.1 What is Spam?

Spam refers to unsolicited, unwanted, or junk emails sent in bulk, typically to large numbers of recipients. While often just annoying, spam can also be a vehicle for scams, malware, and fraud. The term originates from the Monty Python "Spam" sketch — signifying something unwanted and repetitive.

3.2 Types of Spam

3.3 Real-World Spam Case Study: The "Nigerian Prince" Scam

Timeline of a Classic 419 Scam:

Email Sent:
  "Dear Friend, I am Prince Abubakar of Nigeria. I have $25M tied up
   in a bank account and need your help transferring it. In return,
   I will give you 20% — that's $5,000,000! Please send your bank
   details and a processing fee of $5,000 to proceed."

Step 1: Victim responds → Scammer builds trust with fake documents
Step 2: Scammer requests "fees": processing, legal, tax, customs
Step 3: Victim sends money multiple times (each time a new "obstacle")
Step 4: Eventually, scammer disappears or victim is asked to travel
Step 5: In extreme cases, victim is lured to Nigeria and kidnapped

Losses: Victims lose an average of $10,000 — $100,000+

3.4 How Spammers Get Your Email Address

3.5 How to Identify Spam — Advanced Checklist

3.6 Spam Filtering Technologies — How They Work

Bayesian Filtering — Detailed Example

Bayesian filter calculates:
  P(spam|word) = P(word|spam) * P(spam) / P(word)

For email containing: "Congratulations! You won a FREE iPhone!"
                                    
Word            P(spam|word)
─────────────────────────────
Congratulations  0.85 (85% chance spam)
won              0.70
FREE             0.90 (CAPS + FREE = very spammy)
iPhone           0.40 (legitimate use too)
!                0.75

Combined probability: ~95% SPAM

DNSBL — How It Works

1. Receiving server gets an email from IP: 198.51.100.45
2. Server queries DNSBL: 45.100.51.198.zen.spamhaus.org
3. Response:
   - 127.0.0.2 → Listed in SBL (Spamhaus Block List)
   - 127.0.0.3 → Listed in CSS (Exploit Block List)
   - 127.0.0.4 → Listed in XBL (CBL Block List)
   - NXDOMAIN  → Not listed (clean)
4. If listed → Reject or flag email

3.7 Spam Laws and Regulations

3.8 How to Protect Yourself from Spam — Complete Guide

✅ Never publish your email publicly — Use contact forms instead
✅ Use disposable email addresses — temp-mail.org, guerrillamail.com for one-time signups
✅ Create email aliases — Gmail: you+shopping@gmail.com, you+bank@gmail.com
✅ Never reply to spam — Confirms your email is active and gets you added to more lists
✅ Never click "Unsubscribe" in suspicious emails — Legit unsubscribe only for services YOU signed up for
✅ Use a separate email for financial accounts — Keep banking separate from shopping/social
✅ Use strong spam filters — Gmail's filtering is excellent; Outlook's is very good
✅ Report spam — Gmail: Mark as spam; Outlook: Mark as junk
✅ Use catch-all blocking — If you own a domain, block catch-all to prevent directory harvest
✅ Consider a spam-blocking service — For businesses: Proofpoint, Mimecast, Barracuda

Practice Questions

1. Explain the difference between POP3 and IMAP. Which one should you use if you check email on your phone, laptop, and desktop?
2. What does an SMTP server do when it receives your outgoing email? Walk through the steps.
3. List 5 different types of email threats and give a real-world example for each.
4. How does Bayesian spam filtering work? Write a simple explanation.
5. What are DNSBLs and why are they effective against spam?
6. What information can you find in email headers that helps identify a phishing email?
7. How do spammers build their email lists? List 5 methods.
8. What is the CAN-SPAM Act and what does it require from commercial email senders?
9. Why should you never click "Unsubscribe" in a suspicious email?
10. What percentage of malware is delivered via email according to Verizon DBIR?