Can SMTP be relied on to send confidential information and attachments in 2023?

With the concentration of email accounts in big cloud platforms belonging to Microsoft, Google and others, is email more secure today than it was a few years ago?

My hypothesis is that email remains insecure and not suitable for the transmission of confidential information. Yet several (many?) professions rely on email to exchange confidential client information between disparate practitioners and deflect concerns about email security.

Is it more likely today that a SMTP conversation would be protected by TLS? Are emails sent from Google Mail to Microsoft Outlook or Microsoft Exchange Online tenants always encrypted? Is encryption in transit the norm and unencrypted SMTP the exception?

Then there are the concerns about the security of the information at rest or stored in email accounts. People are notorious for not protecting email accounts with adequate authentication requirements. Confidential client information stored in email messages are to my thinking a serious risk.

What do others think?

  • You've asked quite a few different questions all at once.
    – schroeder
    Jun 12, 2023 at 14:36
  • The previous questions asked and cited above are all old, over 5 years old. I was specifically interested in whether the situation has changed today given the shift in hosting of email accounts.
    – aire
    Jun 13, 2023 at 3:04
  • Yes, but nothing has changed. Email hosting has been in place since long before this site existed.
    – schroeder
    Jun 13, 2023 at 7:48
  • As the linked Q&As explain, email tends to be "secure enough" for average use. If you have a concern about the protection for certain classifications of information, then you need to use protections that are appropriate: encrypted attachments, links to file shares with authentication, etc.
    – schroeder
    Jun 13, 2023 at 7:53


Browse other questions tagged .