LearnPart 7 of 8
The protocols behind domains, websites and email
A protocol is an agreed way for two computers to talk. DNS turns names into addresses, HTTPS carries websites, SMTP and IMAP carry email, EPP lets registrars manage domains at registries, RDAP and WHOIS look up who holds a domain, and TLS and DNSSEC keep it all trustworthy.
In 30 seconds
- A protocol is an agreed way for two computers to talk.
- DNS finds things, HTTPS carries websites, SMTP and IMAP carry email.
- EPP is how registrars manage domains at registries; RDAP and WHOIS look up who holds a domain.
- TLS encrypts connections and DNSSEC proves DNS answers are genuine.
Words with a dotted underline explain themselves: tap or hover them.
Every protocol at a glance
| Protocol | What it's for | Port |
|---|---|---|
| DNS | Looking up a domain's addresses and other records. | 53; 853 or 443 encrypted |
| HTTP | Fetching web pages and APIs. | 80 |
| HTTPS | HTTP inside an encrypted TLS connection. | 443 |
| TLS | Encryption and proof of identity for other protocols. | Uses theirs |
| SMTP | Moving email between mail servers. | 25 |
| SMTP submission | Your email app handing mail to your provider. | 587 or 465 |
| IMAP | Reading and syncing a mailbox. | 993 (143 unencrypted) |
| POP3 | Downloading a mailbox to one device. | 995 (110 unencrypted) |
| RDAP | Looking up a domain's registration, as structured data. | 443 |
| WHOIS | The older registration lookup, as plain text. | 43 |
| EPP | Registrars managing domains at registries. | 700 |
| DNSSEC | Signing DNS answers so they can't be forged. | Part of DNS |
Who talks to whom
| From | To | Protocol |
|---|---|---|
| Your device | A recursive resolver | DNS |
| The resolver | Root, extension and domain nameservers | DNS (with DNSSEC checks) |
| Your browser | A web server or CDN | HTTPS |
| Your email app | Your email provider | SMTP submission to send, IMAP to read |
| Your mail server | The recipient's mail server | SMTP |
| Your registrar | The registry | EPP |
| Anyone | The registry or registrar | RDAP (or WHOIS) |
| A certificate authority | Your website or DNS | HTTP or DNS, to check you control the domain |
DNS
The Domain Name System is the internet's directory. A question is tiny, "what are the AAAA records for www.example.com?", so it usually travels as a single UDP packet and comes back the same way. Answers can be any record type: addresses, mail servers, text, aliases, keys.
Plain DNS isn't encrypted, so anyone on the network path can see which names you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the question and answer between your device and the , and most browsers and phones can use them. Every record type is explained in the DNS records guide.
HTTP and HTTPS
HTTP is how browsers and apps ask for things and get them back. A request names a method (GET to fetch, POST to send), a path and the hostname; the response starts with a status code:
| Code | Means |
|---|---|
| 200 | OK, here it is. |
| 301 or 308 | Moved permanently to another address. |
| 302 or 307 | Moved for now; keep using the old address. |
| 404 | Nothing at this path. |
| 500 | The server hit an error. |
| 503 | The server is busy or down for maintenance. |
HTTPS is the same conversation inside TLS. Newer versions make it faster: HTTP/2 sends many files over one connection, and HTTP/3 runs over QUIC, which sets up connections in fewer round trips. A site can also tell browsers to only ever use HTTPS, called HSTS, and some extensions, such as .app and .dev, require it.
TLS
TLS (Transport Layer Security, the successor of SSL) does two jobs: it proves the server is who it says it is, using a certificate for the domain, and it encrypts everything after that. At the start of the connection the browser says which hostname it wants, so a server hosting many sites can present the right certificate. TLS 1.3 is current; versions before 1.2 are retired.
TLS isn't only for websites: email servers use it to encrypt delivery, and IMAP and SMTP submission use it to protect your password and mail. How certificates work.
SMTP, IMAP and POP3
- SMTP (Simple Mail Transfer Protocol) moves mail. Servers deliver to each other on port 25, upgrading to TLS with a command called STARTTLS. Your app sends to your provider on port 587 or 465 after signing in.
- IMAP keeps the mailbox on the server and syncs it to every device: folders, flags, read status.
- POP3 downloads mail to one device. It is still around, but IMAP or a provider's own app has mostly replaced it.
SPF, DKIM and DMARC aren't protocols of their own: they are rules published in DNS that receiving servers check during SMTP. How email works.
WHOIS and RDAP
WHOIS is the original way to ask "who holds this domain?": connect to port 43, send a name, get text back. Every registry formatted the text differently, so software struggled to read it.
RDAP (Registration Data Access Protocol) replaces it with structured data over HTTPS. A list published by IANA says which RDAP server handles each extension. For generic extensions, RDAP has been the official source since January 2025, and many registries have switched WHOIS off. Most personal details are hidden in both; what stays public is the registrar, dates, status codes and nameservers. Try the WHOIS and RDAP lookup.
EPP
The Extensible Provisioning Protocol is how registrars talk to registries. Every registration, renewal, transfer and nameserver change you make at a registrar becomes an EPP command: check, create, renew, transfer, update, delete.
You meet EPP in two places. The auth code (also called an EPP code or transfer code) you give a new registrar is an EPP field. And the status codes in a domain's public record, like clientTransferProhibited, are EPP statuses. What each status means.
DNSSEC
Plain DNS answers can be forged by someone between you and the server. DNSSEC stops that by signing every answer. Your DNS host signs your records (RRSIG records) with a key published as a DNSKEY record, and your registrar puts a fingerprint of that key, a DS record, in the extension's zone. Resolvers follow the chain of signatures from the root down and reject anything that doesn't match.
Before moving a DNSSEC-signed domain to a new DNS host, remove the DS record at the registrar or set up the new host's keys first. A DS record that doesn't match the new keys makes the domain stop resolving for everyone who checks signatures.
Underneath it all: IP, TCP, UDP and ports
- IP gets packets from one address to another. IPv4 addresses look like 203.0.113.10; IPv6 addresses look like 2001:db8::10 and exist because the world ran out of IPv4 ones.
- TCP turns packets into a reliable, ordered stream: web pages, email and EPP use it.
- UDP sends single packets with no setup, which suits quick DNS questions. QUIC builds reliable, encrypted connections on top of UDP for HTTP/3.
- A port is a number that says which service on a machine you want, so one server can run a website on 443 and a mail server on 25 at the same address.
Find your own address with what is my IP.
Questions people ask
What port does DNS use?
Port 53, over UDP for most questions and TCP for large answers. Encrypted DNS uses port 853 (DNS over TLS) or 443 (DNS over HTTPS).
What is the difference between HTTP and HTTPS?
HTTPS is HTTP sent through an encrypted TLS connection, after the server proves its identity with a certificate. Nobody in between can read or change the page, and browsers mark plain HTTP sites as not secure.
What is the difference between IMAP and POP3?
IMAP keeps your mail on the server and syncs it across every device, including folders and read status. POP3 downloads messages to one device and usually removes them from the server. IMAP is what almost everyone uses now.
What is the difference between WHOIS and RDAP?
Both look up who a domain is registered with and when it expires. WHOIS returns free-form text on port 43. RDAP returns structured data over HTTPS, and it is the official lookup for generic extensions since January 2025.
Does DNSSEC encrypt DNS?
No. DNSSEC signs DNS answers so a resolver can tell they are genuine and unchanged. Encrypting lookups so others can't see them is the job of DNS over HTTPS and DNS over TLS.
What is EPP?
The Extensible Provisioning Protocol, which registrars use to register, renew, transfer and update domains at registries. Domain status codes like clientTransferProhibited and transfer auth codes both come from EPP.