1

As per recent updates in UK data protection legislation I have been trying to find ways of encrypting all outbound emails from my server and was considering moving all our emails from a basic email host over to a Windows Server with exchange.

My question is, using an Exchange Server, what is the best way of encrypting all outbound emails and attachments without the need for the recipient to install third party tools to take them to their website to view (i.e. products like Virtru).

  • 1
    To get a more detailed answer, it would be good to know your use cases. For instance: what emails do you send to whom with what content? Are you in a position where you can give out S/MIME certificates? – Tom K. May 4 '18 at 8:09
  • And, do you want end-to-end encryption, or what legs of the transmission do you want to encrypt? – schroeder May 4 '18 at 9:22
  • @schroeder Pretty much a secure platform to use to ensure protection of their data based on its sensitivity. – Connor Simpson May 4 '18 at 11:21
1

There is little you can do. While encryption is supported every step of the way, the only part under your control is your client to your server.

To use encryption when sending from your server to other server, both servers have to support encryption and the receiver client server connection is completely out of your control.

  • You should disallow unencrypted connections to your server (from your clients). There is no reason not to.
  • You may refuse to connect to other servers without encryption, but this will cause e-mails not to be delivered to people, who use servers that don't support encryption.
  • There is no way you can force encryption between recipients server and client, that part is out of your control.

That is why end-to-end encryption (using third party tools such as enigmail) is much superior when communicating using e-mail. E-mail is inehrently insecure, because it has to support variety if legacy servers and clients.

  • I understand; when I looked at third party encrypting for e.g. Virtru, the email it pre-sends to the client looks suspicious anyway. – Connor Simpson May 4 '18 at 7:20
  • From the question I understand this is required by the UK data protection legislation? If this is the case how can they demand this if it is impossible to guarantee? – toom May 4 '18 at 7:24
  • PS: Wow. Virtu seems sketchy AF. Not even a hint what their software actually does anywhere on their site, just filled with buzzwords. An when I finally dug through to a White-Paper, they want me to fill in some shenanigans like number of employees to access it. All and all, would certainly not recommend Virtu. – Peter Harmann May 4 '18 at 7:42
  • 1
    @toom not required at all, but email encryption does satisfy some elements of the regulation, if the org chooses to use it – schroeder May 4 '18 at 9:24
  • 1
    I am with schroeder here, the best solution is to put a link to your site in the email and have them authenticate to you on the link before showing the data. This way, you are in control of the whole thing instead of relying on the mail servers. PS: Or send encrypted files but using your web would be more versatile. – Peter Harmann May 4 '18 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.