Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I send an email from my gmail account to another mail server (apple, microsoft, yahoo...), is the connection encrypted in the path between the two servers?

share|improve this question

migrated from crypto.stackexchange.com Aug 16 '13 at 12:19

This question came from our site for software developers, mathematicians and others interested in cryptography.

marked as duplicate by Xander, Adnan, Iszi, AviD Aug 16 '13 at 15:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Sometimes it is, sometimes it isn't. Even if it is, it might still be vulnerable to active MitM, and finally since all those mailservers aren't trustworthy in the first place, it doesn't really matter if the NSA compels a backbone or microsoft/google. –  CodesInChaos Aug 16 '13 at 9:50
On crypto.SE we deal with questions about cryptography itself. So a question like this fits security.SE better. But don't re-post. We'll migrate it there. –  CodesInChaos Aug 16 '13 at 9:52

1 Answer 1

up vote 4 down vote accepted

Let's see:

$ host -t mx gmail.com
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
$ telnet gmail-smtp-in.l.google.com 25
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP ab10si598143icc.38 - gsmtp
ehlo example.com
250-mx.google.com at your service, []
250-SIZE 35882577

See that "250-STARTTLS" ? It tells me that the SMTP server which handles incoming emails for Gmail supports SSL/TLS, and is ready to use it.

If I try again with apple.com server, I also get an announced SSL/TLS support. Therefore, servers on both sides are apparently ready to use TLS and ought to use it when talking to each other.

That's about the best that can be inferred from the outside. You cannot really know whether a specific email will be protected with SSL while in transit between the two servers, or even whether a given email was SSL-protected, because that's not written in the email itself. Similarly, SSL protects against Man-in-the-Middle attacks only as long as the SSL client duly validates the SSL server's certificate, including revocation checks, and nothing tells us whether Apple and/or Google does that properly. Without such protection, SSL is good only against passive attackers.

Also, remember that SSL is only for data in transit, between two SMTP servers: within the SMTP servers themselves, emails are not encrypted, and won't be encrypted in the destination mailbox (an email service could encrypt emails before storage, in a way precluding decryption by the server itself; Lavabit was doing just that until it was shut down recently; but Gmail does not do that, in particular since they quite openly scan email contents in order to make targeted ads for each user).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.