Is sending email between different Office 365 domains (and organisations) secure?

Question

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.

---

Edit to add: By secure, that the email and it's contents aren't travelling between servers unencrypted and over the public internet.

For example, if I send a document to Colleague A (Bob), and their mailserver is old and has no TLS setup, my email will be sent, over the public internet unencrypted.

Or Bob's mailserver does support encryption however Bob has setup his POP3 mailbox on his client to connect to it without any security, so whilst my email get's to his mailserver encrypted, he downloads it across the public internet unencrypted.

In both these examples, the email and their contents are not secure, they could be intercepted and read without any problems, potentially by any and every network they cross.

On the flip side, does Office 365 maintain the email traffic internally? Even between data centres? Or do the emails go over the public internet at any point? I would assume they are encrypted but is there any documentation to this effect? I have been unable to find anything.

---

Additionally, as the answer from Jeff shows, O365 will use TLS whereever possible, so TLS will (should) be used between data centres, I'm still curious is there's an MPLS / Private network between the data centres and the traffic never leaves the O365 infrastructure?

Answer 1

As luck would have it, Microsoft has documented this. The answer to your question is yes. They use TLS 1.2 between any Office 365 groups, and they also use it opportunistically for external destinations, so as long as the recipient's server supports it, that message path will also be encrypted.

https://technet.microsoft.com/en-us/library/mt163898.aspx

and not to humblebrag or criticize, but to find this I literally googled "does office365 use tls to send email"

Answer 2

Regarding TLS SMTP communications: there is an issue with downgrade attacks.
Basically, you can't trust email transactions to be 100% encrypted.

You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 domain to another) given Edward Snowden's 2013 revelation of PRISM, a US government program to snoop on communications (even between US citizens within the US!) by taking advantage of the fact that Microsoft and other major internet companies would sync data between backend servers on unencrypted network connections across continents.

There was some serious embarrassment suffered by these providers for not encrypting these communications in the first place. It's reasonable to assume that all of them (as well as the rest of the industry's heavyweights) scrambled to fix this as soon as they could.

Being three years later, it should now be safe to assume that these transfers are now secure.

However, because you can't know for sure, any truly sensitive information should have its content encrypted so that even Microsoft cannot read it. (This additionally protects you from subpoenas.)

Answer 3

You read this part, which I emphasized a few keywords:

Office 365 sends mail using TLS encryption, provided that the destination server also supports TLS. If your partner organization supports TLS, you only need to create a connector if you want to enforce certain security restrictions

Then the answer to your question is:

not systematically or…

it depends :).

The following traffics aren't encrypted:

• MX to MX traffic between two Office 365 servers which didn't configure a connector to exchange with each other;

• MX to MX traffic between an Office 365 server and any other MX running for example a Postfix, a Sendmail or an Exchange server;

• client to MX traffic of clients not using Office 365 and not willingly configured to use IMAPS and STARTTLS on top of SMTP.

Moreover, this isn't your question, but need to be reminded in a correct risk analysis approach, there remain a lot of places where your E-mail is in clear and not magically secured (I mean encrypted, protected against unwanted reading):

• on any recipient E-mail client which security you can't ensure, can't imagine, and can't trust :).