What Are the Two Main Methods Used to Encrypt Email?

The two main methods used to encrypt email are transport-level encryption and end-to-end encryption.

Transport-level encryption protects an email while it travels between mail servers, usually through TLS. End-to-end encryption encrypts the actual message so that only the intended recipient can decrypt and read it.

Both methods improve email security, but they protect different parts of the email delivery process.

What Is Email Encryption?

Email encryption is the process of scrambling email content so unauthorized people cannot easily read it.

Encryption can protect:

• The message body

• Email attachments

• Login credentials

• Data traveling between email servers

• Sensitive business or personal information

The level of protection depends on which encryption methods are being used.

For example, a normal Gmail or Microsoft 365 message will typically use encryption while traveling between compatible mail servers. A message protected with S/MIME or PGP can provide stronger protection by encrypting the actual content of the email.

Method 1: Transport-Level Encryption

Transport-level encryption protects an email while it moves across the internet.

The most common technology used for this is Transport Layer Security (TLS).

When you send an email, it normally travels through several steps:

1. Your email client sends the message to your email provider.

2. Your provider's mail server connects with the recipient's mail server.

3. The recipient's server accepts the message.

4. The recipient accesses the message through their email service or email client.

TLS can encrypt the connection between these systems so that someone intercepting the traffic cannot easily read the email while it is being transmitted.

How TLS Email Encryption Works

Modern email servers typically communicate using SMTP, or Simple Mail Transfer Protocol.

SMTP itself was not originally designed to encrypt messages. Technologies such as STARTTLS allow email servers to upgrade an SMTP connection into an encrypted TLS connection.

Once TLS is active, information traveling between the two servers is encrypted.

This helps protect email against attacks such as someone attempting to intercept network traffic between the sender and recipient.

What Transport-Level Encryption Protects

Transport-level encryption primarily provides encryption in transit.

It can protect an email while it moves:

• From an email client to a mail server

• Between two mail servers

• From a mail server to an email application

However, the encryption typically ends once the email reaches the destination server.

That means the email provider may still be technically capable of accessing the message.

Limitations of Transport-Level Encryption

Transport encryption does not necessarily protect the message throughout its entire lifecycle.

For example, imagine someone sends an email from Gmail to Microsoft Outlook.

The connection between Google's and Microsoft's servers may be encrypted with TLS. But after the message reaches the recipient's mailbox, the message itself is not necessarily protected with end-to-end encryption.

This distinction is why TLS should not automatically be considered the same thing as a completely encrypted email.

Method 2: End-to-End Email Encryption

The second major method is end-to-end encryption.

With end-to-end encryption, the actual content of the email is encrypted before it leaves the sender and can only be decrypted by the intended recipient.

Ideally, even the email service providers transferring or storing the message cannot read the encrypted content.

End-to-end email encryption commonly relies on public-key cryptography.

Each user generally has two cryptographic keys:

• A public key, which can be shared with others

• A private key, which should remain secret

The sender uses information associated with the recipient's public key to encrypt the message. The recipient then uses their private key to decrypt it.

S/MIME Email Encryption

S/MIME, or Secure/Multipurpose Internet Mail Extensions, is one of the most established methods for providing end-to-end email encryption.

S/MIME can provide both encryption and digital signatures.

To use S/MIME, users typically obtain digital certificates that connect their identities with cryptographic keys.

These certificates may be issued or validated through a certificate authority.

How S/MIME Works

Suppose Alice wants to send Bob an encrypted email.

Bob provides a public key through his S/MIME certificate.

Alice's email system uses Bob's public key to protect the message. Bob then uses the corresponding private key to decrypt it.

Even if someone intercepts the encrypted email, they should not be able to read the message without Bob's private key.

S/MIME is commonly used in organizations where administrators can centrally manage certificates, email clients and security policies.

PGP and OpenPGP Encryption Methods

Another major approach to end-to-end email encryption is PGP, or Pretty Good Privacy.

OpenPGP is an open standard based on the same general approach.

Like S/MIME, PGP uses public-key cryptography.

Users create a public key that can be distributed to people who want to send them encrypted messages and a private key that remains under their control.

PGP can provide strong encryption, although key management can make it more complicated for everyday users.

Users must securely store their private keys and make sure they are encrypting messages using the correct recipient's public key.

Symmetric Encryption and Email

Symmetric encryption uses the same secret key to encrypt and decrypt information.

It is extremely efficient, which makes it useful for encrypting large amounts of data.

However, symmetric encryption creates an important problem: both parties need access to the same secret key.

If that key is transmitted insecurely, an attacker could potentially obtain it.

For this reason, modern encrypted communication often combines symmetric and asymmetric encryption.

How Symmetric Encryption Works With Public-Key Encryption

A secure email system may generate a temporary symmetric key to encrypt the actual message.

The system can then encrypt that symmetric key using the recipient's public key.

This provides the advantages of both approaches:

• Symmetric encryption efficiently protects the message

• Public-key encryption securely protects the encryption key

This type of combination is often called hybrid encryption.

Comparing the Two Main Email Encryption Methods

Transport-level encryption and end-to-end encryption solve different security problems.

Transport encryption is generally easier to use because modern email providers can enable it automatically.

End-to-end encryption can provide greater confidentiality, but it usually requires additional configuration, certificates, keys or compatible email services.

How Email Providers Use Encryption

Most major email providers support some form of transport encryption.

Services such as Gmail and Microsoft 365 commonly use TLS when communicating with other email systems that support it.

However, this does not necessarily mean every message is end-to-end encrypted.

Some secure email providers are specifically designed to provide stronger message-level encryption.

For example, services such as Proton Mail can provide end-to-end encryption in certain situations, particularly when users communicate within the same encrypted email ecosystem.

The exact protection depends on the email provider, recipient and encryption configuration.

Does Email Encryption Protect Attachments?

Email encryption can also protect attachments, but the level of protection depends on the method being used. With transport-level encryption, the attachment is protected while the email is traveling over the encrypted connection. Once the email reaches the destination mailbox, however, the attachment may no longer have that same protection. With end-to-end encryption, the attachment can be encrypted as part of the message itself. Only someone with the appropriate decryption credentials or private key can access it.

This distinction can be important when sending contracts, financial documents, health information or other sensitive files.

Can Encryption Stop Man-in-the-Middle Attacks?

Encryption can significantly reduce the risk of man-in-the-middle attacks, where an attacker attempts to intercept communications between two systems.

TLS makes intercepted network traffic much harder to read.

End-to-end encryption goes further by protecting the message itself. Even if an attacker manages to intercept the encrypted message, they would still need the appropriate cryptographic key to decrypt it.

However, encryption cannot solve every email security problem.

For example, if an attacker steals someone's email account credentials or compromises their computer, they may be able to access messages after they have been decrypted.

Strong email security therefore also requires measures such as multi-factor authentication, strong passwords and endpoint security.

Which Email Encryption Method Is Better?

Neither method completely replaces the other.

Most organizations benefit from using both transport-level encryption and message-level encryption where appropriate.

Transport encryption should generally be considered a baseline security measure because it protects ordinary email traffic between compatible systems.

End-to-end encryption may be appropriate when sending particularly sensitive information because it protects the actual contents of the message.

Organizations may use technologies such as S/MIME, PGP or specialized encrypted email platforms depending on their security and compliance requirements.

Conclusion

The two main methods used to encrypt email are transport-level encryption and end-to-end encryption. Transport-level encryption, usually provided through TLS, protects email while it travels between mail servers. End-to-end encryption protects the message itself so that only the intended recipient can decrypt it.

Technologies such as TLS, S/MIME, PGP, OpenPGP, symmetric encryption and public-key cryptography may all play different roles in securing email. For most users, transport encryption happens automatically through their email provider. Organizations handling sensitive information may also use end-to-end encryption to provide an additional layer of protection for messages and attachments.