The Hidden Life of an Email: From Send to Inbox in 12 Steps

Sending an email feels instant. You click Send, and seconds later the recipient has it. But in those few seconds, your message passes through a remarkably complex chain of systems. Understanding this chain explains why emails sometimes fail, why spam filters exist, and why email is both incredibly robust and inherently imperfect.

Let us follow a single email from the moment you click Send to the moment it appears in the recipient's inbox.

Step 1: Composition and submission

You compose an email in your email client (Gmail, Outlook, Thunderbird, Apple Mail). When you click Send, the client:

1. Assembles the email in RFC 5322 format (headers + body + MIME parts for attachments)
2. Adds headers: From, To, Date, Subject, Message-ID, MIME-Version
3. Submits the email to your outbound mail server via SMTP (port 587 or 465)

This is the submission phase. Your email client authenticates with your server using your credentials (username + password, or OAuth token). The server verifies you are authorized to send from this address.

Step 2: Sender-side processing

Your outbound mail server (Gmail's servers, Outlook's servers, your company's Exchange server) processes the email:

• Queue: The email is placed in an outbound queue
• DKIM signing: The server adds a cryptographic DKIM signature to the headers, proving the email was sent through authorized infrastructure and was not modified
• Spam check: Some providers scan outbound email to prevent their users from sending spam (protecting their IP reputation)

Step 3: DNS lookup

The sending server needs to know where to deliver the email. It performs a DNS MX (Mail Exchange) lookup on the recipient's domain:

$ dig MX recipient-domain.com +short
10 mx1.cleanbox.to.
20 mx2.cleanbox.to.

The MX records tell the sender which servers accept email for that domain, and in what priority order. The sender connects to the highest-priority (lowest number) server first.

If the recipient uses Cleanbox Relay, the MX records point to Cleanbox instead of the recipient's actual mail server. This is how Cleanbox intercepts and filters email before delivery.

Step 4: SMTP connection

The sending server connects to the receiving server on port 25 (the standard SMTP port) and they perform the SMTP handshake:

Sender:    EHLO mail.sender.com
Receiver:  250-mx1.cleanbox.to Hello
           250-STARTTLS
           250-SIZE 26214400
Sender:    STARTTLS
           (TLS negotiation happens)
Sender:    MAIL FROM:<sender@sender.com>
Receiver:  250 OK
Sender:    RCPT TO:<recipient@recipient.com>
Receiver:  250 OK

Several things happen here:

• EHLO: The sender identifies itself
• STARTTLS: Both sides negotiate TLS encryption for the connection (see TLS in email)
• MAIL FROM: The envelope sender (where bounces go)
• RCPT TO: The recipient address — the receiving server checks if this address exists before accepting data

Step 5: Recipient validation

Before accepting the email data, the receiving server validates the recipient. In Cleanbox, the receiving server validates:

• Does this alias or relay address exist?
• Is it active (not disabled)?
• Is the weekly quota not exceeded?
• Is the linked mailbox active?

If any check fails, the server returns a 5xx error and the sender gets an immediate bounce. The email data is never transmitted.

Step 6: Data transfer

If the recipient is valid, the sender transmits the full email:

Sender:    DATA
Receiver:  354 Start mail input
Sender:    (transmits headers + body + attachments)
Sender:    .
Receiver:  250 OK

The email content is now on the receiving server. Everything that follows is server-side processing.

Step 7: Spam scanning

The receiving server passes the raw email to its spam scanning engine. In Cleanbox, this is Rspamd, which performs dozens of checks in parallel:

• SPF check: Is the sender's IP authorized by the domain's SPF record?
• DKIM verification: Is the DKIM signature valid (email was not modified)?
• DMARC evaluation: Does the email pass the sender's DMARC policy?
• Bayesian classification: Does the content match spam patterns? (see Bayesian filtering)
• URL reputation: Are any links in known phishing/malware databases?
• Content rules: Zero-font tricks, hidden text, phishing layouts
• Crowd-sourced reputation: Have other Cleanbox users reported this sender?
• AI content analysis: Does the AI classifier detect phishing, scams, or social engineering?

Each check produces a symbol with a score. The scores are summed into a total spam score.

Step 8: Virus scanning (relay only)

For relay addresses with ClamAV enabled, the raw email is streamed to the antivirus engine. If a virus signature is matched, the email is rejected immediately — before any other processing.

Step 9: Policy evaluation

The email now passes through the evaluation chain:

1. Contact state: Is the sender blocked? (reject immediately) Whitelisted? (skip spam checks)
2. Shield: Does the gatekeeper allow this sender? Is the rate limit exceeded?
3. Spam threshold: Does the total score exceed your configured threshold?
4. Filters: Do any of your filter rules match? (deny, allow with folder/flags, forward)
5. Quarantine: Is the score between quarantine and reject thresholds?
6. Snoozer: Is it outside the delivery window?

The evaluation produces a decision: deliver, reject, deny, quarantine, or snooze.

Step 10: Header injection

Before delivery, Cleanbox injects informational headers into the email:

X-Cleanbox-Id: message-uuid-here
X-Cleanbox-Spamscore: 1.5
X-Cleanbox-Explanation: legitimate order confirmation from official amazon.com domain
X-Cleanbox-Virusscan: SAFE
Authentication-Results: mx1.cleanbox.to; spf=pass; dkim=pass; dmarc=pass

These headers are visible in your email client's "Show original" or "View headers" option.

Step 11: Delivery

The email is delivered to its final destination:

• Alias (IMAP delivery): Cleanbox connects to your mailbox via IMAP and appends the email to the configured folder. IMAP flags (Seen, Flagged) are applied based on contact state and filter options.
• Relay (SMTP forwarding): Cleanbox forwards the email to your mail server via SMTP, using SRS for SPF alignment and adding the verification token header.

If delivery fails (mailbox unreachable, timeout, full), the message enters the retry queue with exponential backoff.

Step 12: Storage and notification

The raw email is stored in Cleanbox's object storage (encrypted at rest) for your plan's retention period. Message metadata, spam report, and delivery status are stored in the database. If Cloud storage is enabled, attachments are extracted and stored separately.

The recipient's email client checks for new email (via IMAP IDLE or periodic polling) and displays the new message. The recipient sees it. Elapsed time: 2-5 seconds.

What can go wrong at each step

Step	Failure	Result
3 (DNS)	No MX records, DNS timeout	Sender gets immediate bounce
4 (SMTP)	Server unreachable, TLS failure	Sender retries, then bounces
5 (Validation)	Address does not exist, quota exceeded	Sender gets immediate bounce
7 (Spam)	Score exceeds threshold	Email rejected or quarantined
8 (Virus)	Malware detected	Email rejected immediately
9 (Policy)	Contact blocked, rate limit, gatekeeper	Email denied
11 (Delivery)	IMAP/SMTP timeout, auth failure	Retry queue, eventually fails after ~4 days

For a troubleshooting guide when email is not arriving, see 7 Reasons Why Your Emails Are Not Arriving.

The miracle of email

Email is a 50-year-old protocol running on infrastructure managed by thousands of independent operators worldwide. There is no central authority, no single point of control, no registration requirement. Anyone can run a mail server. Anyone can send email to anyone.

That it works at all — reliably delivering billions of messages per day across this decentralized, heterogeneous, adversarial network — is genuinely remarkable. That it works in under 5 seconds is a miracle of engineering.

The next time an email arrives in your inbox, remember: 12 steps, multiple servers, TLS negotiation, DNS lookups, spam analysis, virus scanning, policy evaluation, and IMAP delivery all happened in the time it took you to blink.