Regulated data (health, financial, personal) requires protection in transit at minimum, and increasingly proof of it.
How to implement email encryption#
- Enforce TLS 1.2+ on inbound and outbound connections.
- Publish MTA-STS to prevent downgrade attacks.
- For regulated content, use S/MIME or a secure-message portal with recipient authentication.
- Log and report TLS failures via TLS-RPT.
How to verify it worked#
Send a test message to seed mailboxes at Gmail, Outlook, and Yahoo, then inspect the Authentication-Results and delivery headers. Repeat after any DNS or sending-platform change.
Common mistakes#
- Assuming 'encrypted' in Gmail means end to end; it usually means TLS in transit.
- Deploying S/MIME without a certificate lifecycle plan.
Frequently asked questions#
Is Gmail encrypted?
Gmail uses TLS in transit and encryption at rest. End-to-end encryption requires S/MIME (Workspace Enterprise) or client-side encryption.