Email encryption
Also known as: encrypted email, secure email, message encryption, S/MIME, TLS email
Email encryption converts a message into unreadable code that only the intended recipient can unlock, protecting sensitive information, such as financial details, health records, and contracts, from being read by anyone who intercepts it.
It ranges from automatic transport encryption between mail servers to full end-to-end encryption of the message itself.
Email encryption, explained at three levels
At home
Sending ordinary email is a bit like mailing a postcard: anyone who handles it along the way could read it. Email encryption puts the message in a locked envelope that only the recipient's key can open. Behind the scenes, software scrambles the text with a mathematical key, so anyone who intercepts it sees gibberish, and only the intended reader's software can turn it back into words.
At work
Email encryption turns a message into scrambled code that only the intended recipient can unlock. For a business, it protects things like client financials, health records, and contracts if a message is intercepted or reaches the wrong server. It also helps meet privacy duties, such as PIPEDA's requirement that personal information be protected with safeguards suited to its sensitivity.
At home
There are two layers. Transport encryption, called TLS, protects the connection between two mail servers, much like the padlock in your browser. It is automatic on most services, but it only covers that hop, and the message sits readable on each server. Message encryption protects the content itself. The main types are S/MIME and PGP, which use a pair of keys per person, and portal systems, where the recipient gets a link and signs in to read the message.
At work
Business platforms usually encrypt by rule rather than by hand. A data loss prevention policy scans outgoing mail for patterns, such as a credit card number or a health card number, and when it finds a match, the system encrypts the message automatically. In Microsoft 365 this is Purview Message Encryption; Google Workspace offers S/MIME and client-side encryption on higher tiers. Recipients outside the company typically get a secure link or read the mail directly in Outlook.
At home
End-to-end encryption works with a key pair. Your public key is shared freely and locks messages; your private key stays on your device and unlocks them. With S/MIME or PGP, even the mail provider cannot read the content. The catch is key management: both sides need set-up software, and a lost private key means lost mail. While true end-to-end encryption is the strongest option, in my opinion portal encryption is the practical choice for most small businesses emailing clients.
At work
A complete design has three layers. Enforced TLS between servers, backed by MTA-STS or DANE so a connection cannot quietly fall back to plain text. Policy-based message encryption triggered by DLP rules, with rights management that can block forwarding or expire access. And S/MIME for the few users who need signed, end-to-end mail. The hard parts are certificate and key lifecycle, recipient experience, and making sure archiving, scanning, and eDiscovery can still read what was encrypted.
Real-world examples
At home
Sophie needed to email a client's financial statements. Instead of sending them as a plain attachment, her system detected the sensitive content and automatically encrypted the message, so the client opened it through a secure link and no one in between could read it.
At work
Jerome's clinic must protect patient information by law. Their MSP set up rules that automatically encrypt any email containing health details, delivering them via a secure portal. This kept the clinic compliant while letting staff send information without manually flagging every message.
Common confusions
- Regular email is private enough for sensitive information — Standard email can be intercepted or read in transit and storage. Sensitive data, such as health, financial, or legal information, generally needs explicit encryption to be protected and compliant.
- TLS between servers means my email is fully encrypted — TLS protects each server-to-server hop but not necessarily the whole path or stored content, and it can silently fall back to unencrypted. Message-level encryption is needed for true content protection.
- Encryption makes email too hard for recipients — Modern encryption often uses simple secure links or automatic decryption, so recipients read messages with minimal friction while sensitive content stays protected.
For analysts
Identify what sensitive data your business emails, such as health, financial, legal, or personal information, and set automatic encryption rules for it. Automating encryption by content type protects the data and eases compliance without relying on staff to remember every time.
History & origin
Standard email travels in plain text and can be read by anyone who intercepts it along the way. Transport encryption (TLS) between mail servers became common to protect messages in transit, but it doesn't protect content at rest or guarantee the whole path is encrypted. Message-level encryption standards emerged for stronger protection, and regulations for health and financial data made encrypting sensitive email a compliance requirement for many businesses.