Email encryption is the first line of defense against cybercriminals.
Email is one of the most convenient communication channels for businesses and individuals, thanks to its accessibility. But this also makes email susceptible to cybercriminals who attempt to access sensitive data by intercepting emails in transit or hacking into email servers.
One of the main lines of defense against this attack is email encryption, a widely used way to secure the information sent over email.
Now, you probably have a flurry of questions on this topic, like:
What is email encryption?
How do encrypted emails work?
Why should you encrypt emails?
Read on to find the answers to these and other common questions about encryption and learn how Twilio SendGrid secures emails in transit.
First and foremost, email encryption scrambles the content of an email, converting it into an unreadable format called ciphertext. Once an email is encrypted, only an authorized user (the recipient) can decrypt it and view the original message.
Anyone else who tries to intercept the message will only be able to see the ciphertext—thus, protecting the contents of the email.
There are two main types of email encryption:
Transport Layer Security (TLS): TLS is a protocol that ensures secure communication between email servers. It encrypts the transmission of emails as they travel between servers. While TLS helps secure the transmission, it doesn't necessarily protect the email's content once it reaches the recipient's inbox.
End-to-End Encryption: This method provides a higher level of security by encrypting the email's content at the sender's end and keeping it encrypted until it is decrypted by the intended recipient. No intermediaries, including email service providers, can access the content. PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) are popular protocols for end-to-end encryption.
Email encryption uses cryptographic keys or strings of characters that replace the original data to appear random. And unlike the simple cryptographic keys that people can create, email encryption services generate keys using complex algorithms that scramble the data beyond human recognition.
So how do senders and recipients use these keys to encrypt and decrypt messages? There are 2 ways:
Symmetric cryptography: The sender and the recipient use a single, private key to encrypt and decrypt the message. This means the sender needs to share the key with the recipient so they can decrypt the message.
Asymmetric cryptography: The sender uses a public key to encrypt the message, then the recipient uses a private key (that only they know) to decrypt it. This is also known as public-key cryptography, and unlike symmetric encryption, the sender and recipient don’t need to share the key.
However, today, the most widely used types of encryption tend to rely on a combination of symmetric and asymmetric cryptography, as we’ll discuss later.
Before we answer that, let’s start with a reminder that you should never send sensitive information, like passwords or Social Security numbers, over email.
That said, emails often contain personal information about the recipient, like their address, or business information not intended for the public. And without encryption, bad actors could intercept that information and use it to commit identity theft, fraud, and other crimes against individuals or businesses.
This is why encryption is so important: it ensures that no individual or entity intercepts the content of the email along the way or, in some cases, as it sits in email servers.
Additionally, due to laws like the General Data Protection Legislation, regulators can fine businesses if customers' personal data is compromised. However, encryption can help avoid this.
Confidentiality: Email encryption ensures that only authorized parties can access and read the email content, preventing unauthorized individuals from intercepting sensitive information.
Data Privacy: Email encryption helps maintain the privacy of personal and sensitive data shared via email, protecting it from potential breaches.
Compliance: Many industries and regions have data protection regulations that require secure communication and data handling, making email encryption essential for compliance.
Trust and Security: Implementing email encryption enhances trust between parties by assuring recipients that their communication is secure and protected.
There are 3 common types of email encryption used today. Let’s look at how these work, plus a secure alternative for sending highly sensitive information.
Transport layer security (TLS) is a protocol that encrypts email data as it travels from the sender’s email server to the recipient’s—though it doesn’t encrypt it at its destination. TLS uses asymmetric and symmetric cryptography to encrypt email data. That means it generates and exchanges a session key through asymmetric cryptography, then the sender and recipient use this key to encrypt and decrypt the message.
Many email providers, including SendGrid, use opportunistic TLS encryption by default (more on this below). This prevents cybercriminals from reading the contents of an email while it’s in transit, known as a man-in-the-middle attack.
Most web servers also use TLS for secure browsing—you might recognize it as the lock symbol on a web browser when you’re on a secure website. This type of encryption replaces its predecessor, Secure Sockets Layer (SSL).
Next, we’ll look at types of encryption that secure data on the server.
Pretty Good Privacy (PGP) was the first successful implementation of a public-key encryption solution for email.
In the simplest terms, PGP encryption works by generating a random session key that the sender encrypts using the recipient’s public key. The sender then shares the encrypted session key with the recipient, who can decrypt it with their private key. Finally, the recipient uses this session key to decrypt the message.
PGP encryption protects data as it travels and on the server. This is known as data-at-rest encryption or end-to-end email encryption, and it means only the intended recipient can decrypt the message. Thus, it protects sensitive information from cybercriminals who might target your email server.
To use PGP encryption, users typically need to download an add-on—providers like Outlook, Apple, and Thunderbird have PGP add-ons available. However, the sender and recipient must both install the add-ons and enable PGP encryption to send secure messages.
Secure/Multipurpose Internet Mail Extensions (S/MIME) is a widely used protocol for sending encrypted messages with a digital signature. Like PGP, S/MIME provides end-to-end encryption, securing messages in transit and on the email server.
This protocol also enables the sender to digitally sign the message, authenticating their identity and the integrity of the data they send. So it gives the recipient peace of mind that the message comes from a legitimate sender and no one intercepted or altered the content along the way.
S/MIME also uses asymmetric encryption, requiring public keys from a certificate authority. This means the sender uses the recipient’s public key to encrypt the message, then the recipient decrypts it with their private key. Additionally, the sender uses their private key to digitally sign the message.
Most major email providers—including Microsoft (Exchange and Outlook), Google, and Apple—support S/MIME encryption through plugins. However, both the sender and the recipient need to enable S/MIME encryption to send secure messages. Additionally, administrators can set up S/MIME encryption for all the email users in their organization.
Web portals are a secure alternative to use when you need to share highly sensitive data, such as protected health information or financial information, as it’s best not to send that information over email. Not only is it not worth the risk of compromising the recipient’s data, but regulations like the Health Insurance Portability and Accountability Act (HIPAA) often prohibit it.
With this method, the sender notifies the recipient via email that they have a new encrypted message. The recipient must then log into the secure portal to retrieve the message. This way, you can still enjoy the convenience of communicating over email while protecting the recipient’s data and complying with regulations like HIPAA.
Our system is configured to automatically attempt outbound TLS v1.1 or higher connections when sending emails. In practice, if the recipient's email server accepts incoming TLS v1.1 or higher connections, the email will be delivered via a secure TLS-encrypted connection.
However, if the server does not support TLS, the message will be delivered using the standard unencrypted connection.
We also provide the option to mandate TLS encryption during our email delivery process to your recipients. The Enforced TLS functionality determines whether the recipient must support TLS v1.1 or higher and possess a valid certificate before we proceed with email delivery to their address.
If either the require_tls or require_valid_cert parameter is enabled, the recipient must be capable of supporting TLS 1.1 or higher or possess a valid certificate. Failure to fulfill these criteria will result in Twilio SendGrid declining the message and generating a block event with the description "TLS required but not supported."
Want to know how Twilio SendGrid secures your messages? By default, SendGrid uses opportunistic TLS encryption for outbound emails. This means we attempt to deliver email over a TLS-encrypted connection as long as the recipient’s server accepts an inbound TLSv1.1 or higher connection. However, if the recipient’s server doesn’t support TLS, we deliver the message unencrypted.
You can also opt for the enforced TLS setting, which allows you to specify the recipient has to support TLS. However, if you choose to enforce TLS and the recipient’s inbox provider doesn’t accept the TLS encryption, we won’t deliver the message. You would see this as a block event with the description “TLS required but not supported.”
Now that you have a better understanding of email encryption, learn more about the other email security factors that impact sender reputation and deliverability in our 2024 Email Deliverability Guide.
Or if you’re ready to start sending secure emails with SendGrid, sign up for free today.
