Agencies send on behalf of many client domains and must isolate reputation per client.
What email encryption is#
Email encryption protects messages in transit (TLS between servers, enforced by MTA-STS or DANE) and at rest or end to end (S/MIME, PGP, or portal-based encryption).
Why it matters#
Regulated data (health, financial, personal) requires protection in transit at minimum, and increasingly proof of it.
Implementation plan for marketing agencies#
- Enforce TLS 1.2+ on inbound and outbound connections.
- Publish MTA-STS to prevent downgrade attacks.
- For regulated content, use S/MIME or a secure-message portal with recipient authentication.
- Log and report TLS failures via TLS-RPT.
Priorities specific to marketing agencies#
Agencies send on behalf of many client domains and must isolate reputation per client. Weight your effort toward the steps above that address this constraint first, and measure with metrics that match how marketing agencies generate value from email.
Common mistakes#
- Assuming 'encrypted' in Gmail means end to end; it usually means TLS in transit.
- Deploying S/MIME without a certificate lifecycle plan.
Frequently asked questions#
Is Gmail encrypted?
Gmail uses TLS in transit and encryption at rest. End-to-end encryption requires S/MIME (Workspace Enterprise) or client-side encryption.