Donor lists age quickly; re-engagement and sunset policies protect reputation.
What email encryption is#
Email encryption protects messages in transit (TLS between servers, enforced by MTA-STS or DANE) and at rest or end to end (S/MIME, PGP, or portal-based encryption).
Why it matters#
Regulated data (health, financial, personal) requires protection in transit at minimum, and increasingly proof of it.
Implementation plan for nonprofits#
- Enforce TLS 1.2+ on inbound and outbound connections.
- Publish MTA-STS to prevent downgrade attacks.
- For regulated content, use S/MIME or a secure-message portal with recipient authentication.
- Log and report TLS failures via TLS-RPT.
Priorities specific to nonprofits#
Donor lists age quickly; re-engagement and sunset policies protect reputation. Weight your effort toward the steps above that address this constraint first, and measure with metrics that match how nonprofits generate value from email.
Common mistakes#
- Assuming 'encrypted' in Gmail means end to end; it usually means TLS in transit.
- Deploying S/MIME without a certificate lifecycle plan.
Frequently asked questions#
Is Gmail encrypted?
Gmail uses TLS in transit and encryption at rest. End-to-end encryption requires S/MIME (Workspace Enterprise) or client-side encryption.