Every document that needs to be eIDAS compliant needs to have a qualified timestamp. If we take an email as a document, then the email, based on eIDAS regulations, needs to have an qualified timestamp issued by a qualified CA. As I know, no email client supports to add a qualified timestamp to an email.

Is the email server sent timestamp enough ?

  • "Is the email server sent timestamp enough ?" - which server sent timestamp? Do you mean the received header in the mail? This is not part of a S/MIME or PGP signature and outside of any attached signed documents and thus can be easily faked. This means it is not suitable. Sep 10, 2021 at 12:25
  • @SteffenUllrich So based on this, we can say that emails are not suited to even be eIDAS compliant ? Sep 10, 2021 at 12:30
  • @SteffenUllrich Wouldn't it be better to add the option of adding certified timestamps to emails ? Every important email would have bulletproof evidence, that it was created and sent at the time it was really meant to. Sep 10, 2021 at 12:33
  • Most email is not even signed and/or encrypted in the first place. But there are eiDAS compliant mail services like DE-Mail which also add the necessary timestamps. Sep 10, 2021 at 12:41
  • @SteffenUllrich Thank you for your answers. I am trying to understand the whole concept of eIDAS. So for someone that needs to be eIDAS compliant, just signing the documents right should be enough ? Sep 10, 2021 at 12:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.