I have a php script that sends an email using mail(). The php script lives on domain.com, and it sends the email to info@domain.com. Is this a secure transaction? The website runs over https.

  • One specific way this can fail is when the MX record differs from the A record for the root of the domain. This is very common for larger sites. By the time you need a load balancer on your website, your MX record is pointing somewhere else. (Ignoring the possibility of split horizon DNS).
    – Ladadadada
    Feb 28 '14 at 7:57

It's a good rule of thumb to assume that any email that you send becomes public. If you want to preserve the integrity - sign it. If you want to make sure that no one else can read it - use encryption.


Sending email is never secure, unless you really know what you are doing and take specific precautions to protect your transactions. So if you have to ask, the answer is "no".

Instead, I'd recommend storing sensitive information locally (using appropriate protections) and retrieving it through a secure form.


@tylerl - "Sending email is never secure" <- that is entirely wrong. Email can be sent securely, with and without PGP. Look up TLS. Now where things may go south is if your mail server can't encrypt communications to the recipients' servers.

@Jon - if the sending and receiving mail services are both on the same box as the web service then you'll be fine (though sending mail is separate from the recipient collecting it which may not be secure unless PGP, TLS, etc). We don't know anything about the infrastructure and mail flow since that info was not provided.

Here's my rule of thumb though. I PGP all email by default and turn off PGP when necessary to send a specific email... for example, if the mail doesn't need encrypted and it's going to somebody that doesn't have my key.

  • If sending and receiving mail services are both on the same box, then you should not be using email. You should not even be going through the network.
    – valentinas
    Feb 28 '14 at 22:49
  • I agree but there can be scenarios where it it may be desired or even necessary. Furthermore, just because mail is being sent doesn't mean it's "on the network"... could be over loopback. Mar 1 '14 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.