What CAN-SPAM requires#
CAN-SPAM requires accurate headers, a physical address, and honoring opt-outs within 10 business days.
What email encryption is#
Email encryption protects messages in transit (TLS between servers, enforced by MTA-STS or DANE) and at rest or end to end (S/MIME, PGP, or portal-based encryption).
Why it matters#
Regulated data (health, financial, personal) requires protection in transit at minimum, and increasingly proof of it.
How email encryption supports CAN-SPAM compliance#
Regulators and recipients need to identify who sent a message and trust that opt-out mechanisms work. Email encryption contributes by regulated data (health, financial, personal) requires protection in transit at minimum, and increasingly proof of it.
Implementation steps#
- Enforce TLS 1.2+ on inbound and outbound connections.
- Publish MTA-STS to prevent downgrade attacks.
- For regulated content, use S/MIME or a secure-message portal with recipient authentication.
- Log and report TLS failures via TLS-RPT.
Frequently asked questions#
Is Gmail encrypted?
Gmail uses TLS in transit and encryption at rest. End-to-end encryption requires S/MIME (Workspace Enterprise) or client-side encryption.