01MUA
Application or MUA
Creates the message and selects recipients.
Email ecosystem map
A message crosses multiple systems. Each system sees only part of the incident.
This map separates submission, transport, acceptance, delivery and placement. It also shows the evidence channels available to reconstruct the path.
Primary route
02SMTP
MSA or sending platform
Accepts submission and applies sending rules.
03SMTP · DKIM
Outbound MTA
Selects a route, may add DKIM, and transfers the message.
04MX · SPF · DMARC
DNS and MX
Identify recipient servers and publish policies.
05SMTP · TLS
Recipient gateway or MTA
Accepts, defers or rejects using policy and reputation.
06MDA
MDA and mailbox
Deposits, classifies or quarantines the message.
07IMAP · POP3
Recipient client
Displays the mailbox through webmail, IMAP or POP3.
Evidence channels
Evidence also travels back.
SMTP response
Decision made during a specific transfer.
Delivery status notification
Success, delay or failure generated after an attempt.
DMARC reports
Aggregate and sometimes detailed authentication results.
Feedback loop
Complaint signal returned by a participating provider.
Postmaster dashboards
Reputation, complaint and authentication trends.
Sender and provider logs
Internal events that must be correlated with other evidence.
Four states that must not be confused
Accepted
The next SMTP server took responsibility for the message.
Delivered
The reporting system deposited the message at its destination.
Placed
The message is in the inbox, a category or the spam folder.
Read
A client displayed the message; this signal is not always observable or reliable.