Mail

2023-12-11

E-mail is

Forgeable
Not private

There are many different ways to manage e-mail, depending on what mail service you buy, and on your personal preferences. This note assumes you have already made some choices and want to get what you have chosen working on a Mac.

How E-Mail Works

You compose and view mail in a mail client program, or Mail User Agent (MUA). When you send mail, it is sent through a chain of Mail Transfer Agents (MTAs) to the recipient's MUA, using the Simple Mail Transfer Protocol (SMTP).

Sender's MUA -> SMTP -> MTAs -> Recipient's MUA

Your Mail Setup

Your mail setup depends on two choices: what kind of mail address you have (your mail provider), and how you read and send mail on your Mac (your mail client program).

Your Mail Address

Suppose your mail address is melvin@fooch.com. This name contains an account name, melvin, and a domain name, fooch.com. The domain part after the @ sign identifies your mail service provider; it may be

Your internet connectivity sevice: e.g. comcast.net, bellsouth.net
Some other service you buy: e.g. acm.org, icloud.com, msn.com, outlook.com, live.com
An institution you are associated with: e.g. mit.edu
A free service (often ad supported): e.g. gmail.com, hotmail.com, facebook.com, wanadoo.fr
Your own domain, which you pay for: e.g. formyfriendswithmacs.com

The part after the @ sign ends with a domain name like fooch.com. (.com is the name of a Domain Name Registry in the Domain Name System (DNS). Each registry can look up names like fooch and provide computer address information.) It costs money to provide a mail address, so you are paying for it somehow.

How you Read and Send Your Mail on Your Mac

You have a choice of mail client programs to read and send mail with on your Mac:

a web browser: web mail (gmail, yahoo, hotmail, etc)
Mail.app: mail stored on your computer, read via POP
Mail.app: mail stored on server, read via IMAP
another mail client e.g. Thunderbird (POP or IMAP), Microsoft Entourage, Spark, Mailspring

You can read some kinds of mail with one client, and other kinds of mail with a different client.

Web Mail

If you are using gmail.com, or another provider that supports web mail, you can use a web browser like Safari, Firefox, or Chrome to read your mail on your Mac.

Using Mail.app

Apple provides a mail client application that runs on your Mac, called Mail. Sometimes it is referred to as Mail.app to make it clear that we are talking about the macOS program. Mail.app can store your mail in local folders on your computer's file system, and search a large archive of old mail. You can configure Mail.app to view and fetch your mail from multiple mail providers, including Gmail. Mail.app has a junk mail detector built into it, that detects some spam and moves it to a Junk folder. I use it.

Other mail client applications like Thunderbird and Outlook work similarly.

Apple has a nice introductory article on its Mail.app. Among other topics, it covers adding accounts; rich versus plain formatting; stationery; sending and viewing photos; mail folders, filing and coloring; viewing mail; and checking every n minutes.

If you don't want PDFs to be displayed inline, do the following in Terminal:

defaults write com.apple.mail DisableInlineAttachmentViewing -bool true

Mail Client Considerations

Where mail is stored. you can copy mail to your own hard drive, or leave it at the mail provider. If you leave it at the provider, you can read mail from multiple devices, like your smart phone, tablet, and computer. If you leave it at the provider, there may be a quota or an extra cost if you have too much. If you leave it at the provider, and your mail provider is down, you can't read old mail. If you copy mail to your computer, you have to back it up. If your computer crashes, your old mail might be lost.
Storage cost. Mail occupies disk space somewhere, which is eventually limited. Pictures can get large. You need to know how to delete mail you no longer need, and how to save and back up mail you want to keep.
Multiple devices. If you have a tablet or smartphone as well as a Mac, do you want to read some or all mail on more than one device? You will want a method that ensures that no messages are lost, no matter which devices have read the message.
Mail connectivity when traveling. Suppose you take your computer somewhere, and find a way to connect to the Internet by WiFi or dialup. You'll want to know how to read mail securely and store it safely.
Mail address portability. Suppose you decide to drop cable and get satellite .. or suppose you move to a new state or country and the phone or cable company is different. You might have to change your mail address, and tell all your correspondents.
What the address says about you. The domain portion of your mail address indicates to others whether your account is associated with a verified identity or not. The user name portion of your mail address may indicate the kind of behavior others will expect from you. For example, do you have different expectations about the content of mail from "tom@formyfriendswithmacs.com" versus "sexkitten307@tickle.ru"?
Spam filtering. Your needs here depend on how much spam you are willing to deal with. Some mail providers, e.g. gmail, do spam filtering before it gets to you. Some mail clients, e.g. Mail.app, learn what you think is junk.
Address book. Some mail clients, e.g. Mail.app, use the Mac OS X Address Book. Some web mail providers may allow you to dump your OS X Contacts and upload them to the web. (You have to decide if you trust your provider to keep your data secure.) Other clients, e.g. Entourage, have their own address book.
Long term considerations. Some mail providers have gone out of business, or changed their rules to make using their service unacceptable. If yours ever does, you'll have to get a new mail address, and tell everybody, and preserve your old mail.
Multiple e-mail accounts. You might wish to have multiple e-mail accounts, perhaps one for work and one for personal matters. Depending on your needs, you might wish to store all this mail mixed together on your Mac, or keep it separated. Professionals like doctors and lawyers might be required to pay special attention to the security and privacy of mail they handle.

Recommendation

I recommend getting a gmail.com account, provided by Google. Even if you have some other address, you should get a gmail account as a secondary.

It's free (because they look at your mail to target ads).
They do very good spam filtering.
It has a nice interface. Gmail supports its own address book and folders.
It provides storage for up to 9GB of mail, which is a lot.
It's accessible from any web browser, so you can read your mail on the road without bringing a computer.
Understand that it is supported by advertising.

How I Handle Mail

My e-mail handling practices might not meet your needs. I use Mail.app on my Mac, and the Mail application on an iPhone when I am traveling.

My main mail address is hosted at the mail provider that hosts my personal domain. I pay a separate ISP for Web and e-mail connectivity.
Mail comes to the ISP and is filtered there by complex filters I built and maintain myself.
I fetch mail messages from multiple accounts to my Mac using Mail.app and delete it from the servers.

My page How I Filter Spam describes how I filter spam at my mail provider account. When I read my mail on my Mac, I can save interesting mail in local folders on my Mac, and search them later. Selected non-bulk small mail is copied to a mail provider mailbox that I can read with my iPhone or a web browser.

Reading Mail From Multiple Accounts

You may set up several different mail addresses, for different purposes. Using webmail, you would go to a web page for each account. If you prefer to copy the mail off the mail server, then each mail account has a "home" computer where its mail resides. You can "peek" at the mail on an account, and copy its mail to a non-home computer without deleting the server copy. Using a local mail client on your Mac, you can pull all the mail from different accounts into one view. Some offices use Microsoft Exchange for their mail server, and Macs work better with Exchange than they used to. Many work situations require that you read mail only from "inside" their network, and provide a Virtual Private Network (VPN) solution that lets a remote computer connect to the network over a cryptographically secured tunnel.

What About iCloud?

What it can do for you: Back To My Mac, Find My iPhone, contact syncing, optional mail address. What it costs: 5GB free for Mac/iPhone owners, can buy more.

Privacy and Security Issues

E-mail Is Not Private

E-mail flows across the Internet unencrypted. A bad guy can read all your mail. This has actually happened.

Do not send credit card numbers in e-mail -- or passwords, Social Security Numbers, and other data you don't want public. (The idea of encrypting the mail somehow has been discussed for over 30 years, but it's still not usable except by experts.) If a mail message is stored on disk on any computer (for example at a mail provider), a bad guy could get into it and read it. Law enforcement can compel a mail provider or network operator to let them read your mail. Even if you think you have deleted a message, plenty of news stories show that old e-mail can come back. So basically, don't put anything in an e-mail that you wouldn't post on your front door.

Use SSL anyway

If you have a choice, use encryption between your computer and the mail provider. Even though mail is not private, setting this attribute is usually easy and protects your mail from casual snoopers.

E-Mail Can Be Forged

A bad guy can create a mail message that appears to come from someone else, like a bank. There is no way to prevent this and detecting whether a message is forged requires intelligence and skill. This is another good reason to never click on links in an e-mail message.

You can turn off inline previewing of attachments such as PDFs and images by:

   defaults write com.apple.mail DisableInlineAttachmentViewing -bool yes

How To Read Mail Headers

Sometimes you want to check if a mail message is forged. You can spot many forgeries by examining the detailed mail header lines. View the raw mail (⌘⌥U in Mail.app) (View Full Headers in various webmail programs).

Most of the headers, like the From:, To:, and CC: are completely under the control of the sender. If you get mail claiming to be From: george.washington@whitehouse.gov, this sender name may have been made up. Some of the headers were created when the message was delivered to your mail client, and these can be believed.

Look at the Received: entries (each one may be multiple lines). The most recent one is at the top, and so they read in reverse time order. You can trust the top Received header, which was created by your mail service provider. You may be able to trust the one before that, if it was also created by the mail provider. Reading downwards, you will eventually find a header created by your mail provider describing a message it received from an untrusted source. The rest of the headers cannot be trusted.

Example. I got a mail message that included these header lines:

    Received: (qmail 58489 invoked from network); 25 May 2010 01:05:22 -0000
    Received: from mailwash15.pair.com (66.39.2.15)
      by niwun.pair.com with SMTP; 25 May 2010 01:05:22 -0000
    Received: from localhost (localhost [127.0.0.1])
	    by mailwash15.pair.com (Postfix) with SMTP id 3F7BF82813
	    for <example@multicians.org>; Mon, 24 May 2010 21:05:22 -0400 (EDT)
    Received: from nrec.org (ns.nrec.org [207.74.238.21])
	    by mailwash15.pair.com (Postfix) with ESMTP id ED61B82811
	    for <example@multicians.org>; Mon, 24 May 2010 21:05:21 -0400 (EDT)

You need to know the pattern of headers for your mail provider's internal network. Sometimes, the first few headers are not interesting: they show how your mail host's machines work together. In the example above, the first three Received headers are not interesting, but the fourth one, created by my mail provider (pair.com), indicates that it got a message from an outside host (nrec.org). In general you cannot trust any headers after this "last hop" header: they can be forged by spammers. What you can trust in the last hop header is the Internet Protocol (IP) address that your mail provider got the message from.

In this example, "207.74.238.21" is the key unforgeable piece of data in the headers above. It is the actual IP address that sent the mail to my ISP. The mail server at that location claimed to be "nrec.org" (the first "from" in the header) and my mail host looked up the IP and found the domain name "ns.nrec.org" (the name inside the parentheses).

You may wish to look up data for some domains. I have a program that takes an IP address and attempts to look up where it is located, in a "geolocation" database. It says that 207.74.238.21 is located in "US/Traverse City MI" (which is correct). My filtering software adds a header to the mail if it can find a geographic location, and I display this field in Mail.app.