Feb 6, 2023 By Priyanka Tomar Back

Popular Terms used in email communication | Email Investigation Terminology

Domain name – A domain name is a memorable address used to identify a website.
For example, “google.com” is the domain name of Google website. The “google” part of the domain name is called the “second-level domain,” and the “.com” part is called the “top-level domain” (TLD).

Mail User Agent (MUA) is software component that allows users to compose, send, receive, and manage email messages. The MUA is responsible for creating and formatting the email message, as well as managing the user’s email folders and address book. Examples of MUAs include email clients.
There are two types of email clients- standalone – Apple mail, Microsoft outlook, Mozilla thunderbird etc. Web based client– Gmail, yahoo, Hotmail etc.
The MUA is responsible for creating and formatting the email message, as well as managing the user’s email folders and address book.

Mail Delivery Agent Software (MDA) or Mail Transfer Agent (MTA) is a software program that is responsible for the delivery of email messages from one computer to another. MTAs work by using the Simple Mail Transfer Protocol (SMTP) to send and receive messages between mail servers. The MTA on the sending end is responsible for sending the message to the recipient’s mail server, while the MTA on the receiving end is responsible for delivering the message to the recipient’s email client or webmail interface.

Some examples of popular MTAs include Postfix, Exim, and Sendmail. These MTAs are used by many companies and organizations to handle their email traffic, and they are often configured to work with other email-related software such as antivirus and spam filters to help ensure that only legitimate email messages are delivered.

Simple Mail Transfer Protocol (SMTP) is the standard protocol for sending email messages between servers. Email systems that send mail over the Internet use SMTP to send messages from one server to another, and to deliver messages to local mail clients like Microsoft Outlook or Apple Mail etc.

POP (Post Office Protocol) is a protocol used to retrieve email from a mail server. It is typically used by email clients such as Microsoft Outlook, Apple Mail, and Thunderbird. POP clients connect to a mail server, retrieve all the messages, and then disconnect. Once the messages are downloaded, they are typically removed from the server. This means that if you want to access your emails from multiple devices, you will have to download them multiple times.

IMAP, the Internet Message Access Protocol, is a protocol used to retrieve and manage email messages from a mail server. It is typically used by email clients such as Microsoft Outlook, Apple Mail, and Thunderbird. IMAP clients connect to a mail server and can retrieve and manage email messages without having to download them. This means that if you want to access your emails from multiple devices, you can do so without having to download them multiple times. IMAP supports many features that POP does not, therefore IMAP is generally considered to be a better choice than POP as it offers more flexibility and functionality.

IP address- Internet Protocol – IP stands for Internet Protocol. It is the primary protocol that is used to send and receive data over the internet. It is responsible for routing data packets from one network device to another based on their IP addresses. There are two versions of IP in use today: IPv4 and IPv6.

What is Port – A port is a virtual endpoint of a network communication channel. It is a 16-bit number that is used to identify specific processes or services on a computer or device. When a network packet is sent to a specific IP address, the operating system uses the destination port number to determine which program or process should receive the data. This allows multiple programs or services to run on the same machine, each using its own unique port number.

For example for HTTP traffic is sent over port 80) and for HTTPS traffic is typically sent over port 443), SSH traffic is typically sent over port 22. These are the default ports for these protocols, but they can be configured to use other ports as well.

SSL (Secure Sockets Layer) is a protocol for establishing secure connections between web servers and clients. It is used to encrypt data sent over the internet, such as credit card numbers and login credentials, to prevent it from being intercepted by unauthorized parties. SSL was replaced by TLS (Transport Layer Security) in 1999, but the term “SSL” is still commonly used.

Sender Policy Framework (SPF) is an email authentication method designed to detect forged sender addresses in emails (email spoofing), a common vulnerability, by verifying that incoming mail from a domain comes from an IP address authorized by that domain’s administrators. It is a type of DNS TXT record that identifies which mail servers are authorized to send email on behalf of a domain. Mail exchangers use the DNS to check that mail from a given domain is being sent by a host sanctioned by that domain’s administrator.

DomainKeys Identified Mail (DKIM) is an email authentication method. It allows the person receiving the email to check that it was actually sent by the domain it claims to be sent from, and that it hasn’t been modified during transmission. This is done by using a digital signature, which is added to the message headers. The signature is based on a private key, which is held by the email sender, and a public key, which is published in the DNS. The recipient can use the public key to verify the signature, and thus confirm that the message is authentic.

Domain-based Message Authentication, Reporting & Conformance (DMARC) is an email authentication protocol. It builds upon the widely deployed SPF and DKIM protocols, adding a reporting function that allows senders and receivers to improve and monitor protection of the domain from fraudulent email. DMARC allows a domain owner to publish a policy in their DNS records that specifies which mechanism(s) (e.g. SPF, DKIM) are used to authenticate email messages sent from their domain, as well as instructions for receivers on what to do if neither mechanism passes. It also provides a way for email receivers to report back to the domain owner about messages that pass and/or fail the evaluation of the domain owner’s published policy.