If I understand correctly, TLS encrypts the 'tunnel' that the message is communicated through, while not encrypting the actual content of the e-mail or any of its attachments. Is this correct?
The email content passes encrypted through the tunnel, so it's won't be in plain through the wire (). It's like downloading a zip file through https. The zip itself won't have a password, but it was downloaded securely.
(Of course, you could use PGP in the email as well)
if TLS is specified, all relaying servers in between will use TLS…
That's wrong. TLS in emails, is hop-by-hop. You may transmit encrypted to the next relay, but if encryption is unavailable to the next, it will be transmitted in the plain. You could specify the XSECURITY ESMTP extension to request otherwise, but I think only courier mailservers support it.
If this is the case, am I right in saying that the content of the e-mail is potentially vulnerable to being intercepted at any server that is involved in SMTP relay between our outbound mail server and the recipients mail server?
Yes. While protected in transit, the content is fully available in the intermediate hosts so a malicious email relay could steal the contents. Thus, their output email host is probably connecting to your web server directly, not through any untrusted relay. Then, by using a (trusted) certificate, their mailserver can ensure that their server is connecting to yours, with no intermediate relay.
There are a number of caveats if you want true security, though:
- First of all, they would somehow ensure they are not receiving a malicious MX dns reply, since you are probably not using dnssec.
- The sending email server would need to verify that the certificate is trusted (it is pinned, or signed by a trusted CA…). By default, MTA will accept any certificate, as there too many self-signed ones so far.
- Equally, when you are replying, your server should need to be equally hardened. What's good in having a perfect email server, if your replies are then quoting your secret contents, and sent with a MTA that is not taking advantage of the secure tunnel you offer?
Still, just will protect against passive eavesdroppers, such as a government agency snooping on the submarine cables.