How email really travels
SMTP is still a chain of servers. From is a costume. Open money sites from a bookmark.
Email feels instant and personal. Underneath it is closer to a postcard passed through several post offices. SMTP is the old protocol that still moves most of it. Your app talks to a mail server. That server talks to another. The last one drops the message in a mailbox. Each hop can add a header. Most people never look.
From is a costume
The “From” line is easy to fake. That is not a new trick. Mail servers that care check SPF, DKIM, and DMARC: records on the domain that say who is allowed to send as that name, and a signature that the domain owner set up. When those records are missing or “none,” a copycat message looks boringly real.
A bank that still sends as a free Gmail address is not a bank. A message that says it is from Apple and the full address is `apple-support@randomhost.net` is not Apple. Open the raw sender, not the friendly display name.
What stays on the wire
If both sides use TLS, the body is harder to read in transit. The subject and the metadata still travel. Copies sit on disks you do not own: your provider, theirs, maybe an employer archive. “Delete” in the app is a request. It is not a shredder.
Attachments and links
The payload is still the usual crime. A PDF that is actually a program. A link that is a login page. Mail is the delivery van. The van is old. The packages are new. Do not open the van because the label used your first name. Anyone can buy a list with first names.
If money or a password is involved, leave the message. Open the site from a bookmark. That one habit kills a large share of the mail that was only ever trying to be a van.