memes

Depends. Usually not. It hops from your computer to your email provider which then looks up the server of the recipient and sends it there. The recipient's server might send it on internally and in big installations probably does so.

It is theoretically possible that one of the involved parties has a third party authorised to accept mails on their behalf in case of outages. I don't believe that is very common nowadays. It's much more likely that your provider will keep the mail for a few hours to days when it can't reach the recipient.

But ideally only your provider and the recipient's provider can read the mail with all connections in between being encrypted. There's just no guarantee that all paths are encrypted. But I think nowadays that is much more likely than it used to be, thanks to Let's Encrypt.

Now, if you don't want any of the servers to be able to read the mail you have to encrypt it with something like GPG. But for that to work you need the recipient's key. But hardly anyone uses that. And it only encrypts the content of the mail. Not the metadata.

If you control the DNS and the mail server, you get to decide where it goes. However, if any senders or recipients are on gmail, Google basically has all of those emails' content.

That was the theory, nowadays moest email goes from google or microsoft to google or microsoft. At least 99% of the rest goes directly from the senders provider to the recipients provider. Afaik none of the larger providers still accept non-TLS connections.

@daniskarma @laurenceOfSuburbia yeah the complication is not technical so much as bureaucratic. Email itself is simple, but then you have to jump through hoops of tuning various other technical settings for Big Email to allow you in

I think it's usually to do with sending, so if you're only interested in receiving I think you'll be fine (unless your server uptime's really bad or something)

Self hosting receiving mail is honestly, pretty straightforward, all things considered. Setup your MX record to point at a server you control, configure software to save messages however you want. Perhaps the most complicated step is wiring up certbot or similar software to get your SSL certificate for your mailserver. A Debian Linux system, apt-get install postfix; apt-get install dovecot will get you nearly 90% of the way there.

Depending on your preference. there are docker containers that can do 100% of the process too, with all sorts of nice bells and whistles. If you don't care about sending email, you can skip DKIM/SPF/DMARC. (though, if you are never sending from your domain, check here: https://www.cloudflare.com/learning/dns/dns-records/protect-domains-without-email/ -- there are some entries you can add to DNS to make sure everyone else knows)