If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?


2 Answers 2


Yes, it can be read or altered if TLS is not used either between the sender and their mail server, or between the mail servers involved in handling the message, then anyone who is able to see the traffic between them can read or even alter the message in the clear. They would need to have control of a system along the routing of the traffic so it isn't super likely, but it is certainly possible.

It is very difficult to ensure that TLS is used on all links, so if you need security for the message you should encrypt the message on the client prior to sending it.

  • I was thinking more like the traffic goes through their router and everything is recorded. Jun 21, 2013 at 2:38
  • Or an offloader. Jun 21, 2013 at 3:07
  • Offloaders would give certificate warnings Jun 21, 2013 at 6:13
  • 1
    Ack, just realized the main question and actual question in the description are inversions of each other. I answered Yes, the attacker can read the e-mail. I will clarify. Jun 21, 2013 at 13:41
  • Note that while TLS may be used on some of the links, it's very hard to assure that it's used on all links (especially when the message is forwarded between mail servers). The best way to guarantee security is end-to-end (i.e. client-to-client) encryption and signing (as in @woliveirajr's answer). Jun 21, 2013 at 15:24

Yes, it can be read very easily. Imagine the following:

your computer -> your ISP -> your email provider -> some router on the internet -> the email provider destination -> his ISP -> his computer

From your computer to his computer, all information is in plain-text. A malicious person in the ISP, or anyone having access to the internet router, etc, can simple read it, without any problems. And you won't even notice it.

To protect the email from readings, you have to encrypt it. So the person will only see what will look random bytes and won't know what you've wrote.

And since the email is in plain-text, it's easy to replace anything inside it, changing some part or the whole thing, and the receiver won't know if it was tempered since you send it. And encryption won't solve that either, if just encryption is used: the malicious person won't know what was written, but can replace the entire email with something else.

To prevent that, you need to sign the email: the signature will assure that it wasn't changed in transit.

combining both (signature + encryption) you can guarantee that no one will read it, and that any change will be noticed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .