Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?

share|improve this question
Definitely worth asking them to enable it - it will make life safer for both parties! – Rory Alsop Nov 29 '12 at 18:35
up vote 9 down vote accepted

Email is not secure. By default, it is not authenticated. SSL/TLS on SMTP and IMAP, at best, protect the emails while in transit, not when they are at rest; and you cannot be sure that such protection has been applied.

To some extent, when sending emails within a given organization, you might know that SSL/TLS was enforced on both SMTP and IMAP, and the confidentiality issue is "just" a matter of storage on the server side. But you cannot have the same kind of guarantee when the email must cross organization boundaries.

To get proper end-to-end security for emails, look up S/MIME and OpenPGP. The tools themselves won't ensure absolute security, because part of security is what the users do and understand, but at least these tools allow the achievement of secure emailing.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.