What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Question

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer?

On which port does the email travel? HTTP, SMTP, POP3?

Answer 1

Let us break this down into three parts:

1. Between domains, the protocol is SMTP, which is essentially a relayed protocol. If SSL/TLS is not being used, a sniffer will detect anything. If SSL/TLS is being used, a packet sniffer will be able to know the from and to IP addresses, and any relay on the way would have to decrypt and then re-encrypt the email.

2. If using POP/IMAP/SMTP from a thick client (e.g. Outlook) to any one of these services, the port numbers vary but there are well-known ones.

3. If using the Web interface of these services, then the ports are 80 (HTTP) and/or 443 (HTTPS) from your user agent (browser) to the originating domain - (Google or Yahoo). There, the packets are de-crypted to clear-text and then optionally re-encrypted if the target domain or a relay supports SSL/TLS over SMTP. After that, the process reverses itself: If your target domain's user is also using a browser, then the reverse will happen and clear-text email stored on the target domain's mail server will be encrypted to HTTPS sent over client ports (random ports) to the end user.

In short,

• if not using SSL/TLS, everything is visible.
• if using SSL/TLS, everything is visible to the relays but not in transit.
• port numbers may vary.