SMTP is Killing Email

Every time I have to do a mail server upgrade and have to tinker with my virtual mailbox configuration, I think about how it would be easier to just write my own mail daemon.

Every time I have to do a mail server upgrade and have to tinker with my virtual mailbox configuration, I think about how it would be easier to just write my own mail daemon. These upgrades happen more than I would like. Consider the back to back vulnerabilities in exim over the past few months. In writing my mail daemon, I’d apply web technologies, such as URL routing, to email, but I always shelve the idea, because I’d still have to deal with SMTP, which offers no benefits, but considerably complicates both programming and configuration. I am not alone in experiencing these difficulties. Our collective trouble with email will lead to its eventual demise.

  • Email’s usefulness is reduced by the volume of spam users deal with.

  • Mail servers suffer from frequent exploits.

  • Mail servers are difficult to administer.

  • Mail servers haven’t kept up with mainstream technology, because they must support an archaic mail delivery protocol.

I don’t mean that people will no longer communicate on the Internet, of course. Rather, the classical technology we call “email”, which is the delivery of messages to “” style addresses via SMTP, is going to go away. The Internet sees SMTP as “damaged” and is routing around it accordingly.

Technologies to replace email take a number of forms. Facebook wants to replace email with their own internal messaging system. Instant messaging services mimic email functionality, especially if they support offline messaging. Even the popular email services such as gmail, hotmail, and yahoo mail are proprietary services that provide SMTP gateways.

The problem is not the emails themselves. The problem is SMTP. It’s an archaic protocol from a more trusting age. Spammers take advantage of this trust. They break into insecure client systems to send spam through poorly configured mail servers. Failing that, they directly attack exploitable mail servers. Attempts have been made, such as Domain Keys, to add some security to SMTP, but it’s an ineffective hack to a protocol that has outlived its usefulness. So useless has it become, that some ISPs have blocked mail clients from using it.

This transition is already happening. The popular email services built ad hoc client side HTTP interfaces to support their web applications, but they still rely on SMTP as a gateway to other mail networks. The Internet needs a standard email gateway protocol to replace SMTP, so we can avoid the fracturing of email systems into technological fiefdoms which do not interoperate.

Some of the benefits of moving email to HTTP:

  • Rich email applications. Compare joining a mailing list to a Facebook group.

  • Program in your favorite language. Instead of learning the intricacies of a mail daemon, all you need are the correct HTTP urls to accept and deliver mail.

  • Leverage the web: HTTPS, load balancing, distributed urls, resource manipulation, rich clients and javascript programmability.

  • Less exploitable surface area. Although Web servers suffer from exploits, too, removing a separate mail daemon reduces the code developers have to maintain, and there are many more web developers than email developers.

Email wasn’t always delivered via SMTP, although the protocol has been around for about 30 years. At one point, email piggybacked on FTP. HTTP has largely subsumed the functionality of protocols like FTP, gopher, and finger, except in legacy contexts. SMTP should be retired, too. The transport protocol for email should be HTTP.

Has email become more trouble than it’s worth for you? What do you use instead? Let me know in the comments.

Written by

Liam Irish

Liam Irish is a software architect for CA Technologies Advanced Technology Group within the Office…

Published in

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!


    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website.



  • king lear

    testing comment functionality, please do not publish this

  • Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.

    Nice Post and Timely!


    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.