Is Email Encrypted? SSL, TLS and Email Encryption

Most email is encrypted only while it travels. TLS (Transport Layer Security) encrypts the connection between mail servers, not the message. Each provider can still read the email, and so can anyone who gets into either mailbox.

A bookkeeper who emails a payroll summary from Microsoft 365 to a client on Gmail is almost certainly covered on the way, because both providers use TLS. The summary still sits readable in both mailboxes. Keeping it locked after it lands takes email encryption of the message itself, or a password on the attachment.

Email encryption in transit and end to end

Email encryption comes in two kinds. Encryption in transit protects each connection the email crosses. End-to-end encryption locks the message on the sender's device, and only the recipient's key opens it. Almost every email gets the first, and very few get the second.

An email crosses at least three connections, and each needs its own encryption:

1. Your device to your provider. Webmail runs over HTTPS, which Gmail has used by default since 2010. A mail app or a scanner sends over TLS on port 587 or 465.
2. Your provider to the recipient's provider. The sending server asks for TLS with a command called STARTTLS, defined in the standard Request for Comments (RFC) 3207, and uses it if the other server agrees.
3. The recipient's provider to their device. HTTPS or TLS again, set by their provider.

Between those connections, the email sits on servers, where TLS no longer covers it (Google's email encryption FAQ).

Many mail apps still label this setting SSL (Secure Sockets Layer), the name of TLS's predecessor. In those menus, SSL usually means TLS from the first byte, on port 465.

S/MIME (Secure/Multipurpose Internet Mail Extensions) and OpenPGP are the two end-to-end standards. These are the options open to a small business:

Method	What it locks	What stays visible	What the recipient needs
TLS (standard email)	Each connection between servers	The whole message, to both providers and to anyone inside either mailbox	Nothing
S/MIME or OpenPGP	The message and its attachments	The sender, the recipients and the subject line	A certificate (S/MIME) or OpenPGP software, with keys exchanged in advance
Password-protected file	The attached file only	The email text and the file name	The password, sent another way

The Information Commission's Office (ICO) points out that both kinds of end-to-end email encryption need setup on each side before the first message (encryption scenarios). Lose the private key, and the ICO warns you may not be able to decrypt those emails.

Is Gmail encrypted?

Gmail uses TLS on every message automatically, for all accounts (Gmail Help). It protects the message only when the other provider supports TLS too, and in Google's Transparency Report almost all of them do.

Between 27 July and 19 October 2026, 97% to 99% of the mail Gmail sent to other providers was encrypted each day. Incoming mail showed 100% on every day. Google excludes spam from these figures.

Gmail shows the level as an icon next to the recipient. Google's encryption help page listed four on 25 October 2026:

Icon	Gmail's name	What it means	Available to
Grey lock	Standard encryption	The message travelled over TLS	All Gmail accounts
Green lock	Enhanced encryption	Hosted S/MIME; Google keeps a copy of the key	Work or school accounts
Blue shield	Additional encryption	Client-side encryption; your organisation holds the only key	Work or school accounts
Red open lock	No encryption	The message was not encrypted, so do not send sensitive information that way	Any account

To check a message you received, open it and click Show details next to the recipient. The security line reads Standard encryption (TLS), Enhanced encryption (S/MIME) or No encryption supported (Gmail Help).

Before you send, Message security in the compose window shows the same on a computer or an Android phone.

Gmail can warn even about an encrypted message. Google gives two reasons: encryption to that provider failed before, or you sent from your own domain, not @gmail.com.

Is Outlook email encrypted?

Yes, in transit: Microsoft 365 encrypts email with TLS by default, though not end to end. Exchange Online tries TLS on every connection, starting with the strongest version. It sends without encryption only when the recipient's server cannot do TLS (Microsoft Learn).

Mail between Microsoft 365 organisations always travels over TLS. An administrator can require TLS for partners such as a bank, using connectors in the Exchange admin center.

Forwarding can undo it. Microsoft's example: a message that arrived over TLS, forwarded to an organisation without TLS, may travel that next hop unencrypted.

In Outlook or any other app, the full header records every hop in its Received lines. A line marked ESMTPS, short for extended SMTP with STARTTLS (RFC 3848), was encrypted.

How to send an encrypted email in Outlook

To lock the message itself, new Outlook offers two kinds of email encryption (Microsoft Support):

• Microsoft Purview Message Encryption: in the message, choose Options, then Encrypt, and pick Encrypt or Do Not Forward. Microsoft's note for new Outlook names an Office 365 Enterprise E3 licence for this. A recipient on another email service gets a link to read it in Microsoft's portal.
• S/MIME: choose Options, then More Options, and tick Encrypt this message (S/MIME). You need your own certificate set up, and the certificate of each recipient outside your organisation installed. Without the E3 licence, this is the method new Outlook offers.

Both need a qualifying Microsoft 365 subscription. An Outlook.com account without one can open encrypted messages but cannot send them (Microsoft Support).

When TLS is skipped, and how to require it

TLS between mail servers is opportunistic. If the receiving server does not offer it, the sender usually delivers the email in plain text and warns no one.

An attacker on the network can force that fallback. RFC 3207 describes the attack: remove the server's offer of STARTTLS, and the sender never tries to encrypt.

A mail transfer agent (MTA) is a server that passes email on. MTA-STS (MTA Strict Transport Security, RFC 8461) lets your domain tell sending servers to require TLS. It uses a TXT (text) record at _mta-sts and a policy file listing your mail servers. TLS-RPT (TLS Reporting, RFC 8460) adds a TXT record at _smtp._tls, with an address for daily reports on TLS connections, failures included.

In enforce mode, senders that support MTA-STS must not deliver without TLS and a valid certificate. The National Cyber Security Centre (NCSC) recommends starting in testing mode with TLS-RPT, then enforcing after a month or more without failures (NCSC). The policy covers only mail you receive.

Our own domain publishes neither record. The first two lookups below, run for mailgraf.com at 02:23 London time on 25 October 2026, returned nothing. The NCSC's domain publishes an enforce policy:

$ dig +short TXT _mta-sts.mailgraf.com
$ dig +short TXT _smtp._tls.mailgraf.com
$ dig +short TXT _mta-sts.ncsc.gov.uk
"v=STSv1; id=3dca128e3bcfa2d5f305165c72e9ad5c"
$ curl https://mta-sts.ncsc.gov.uk/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: ncsc-gov-uk.mail.protection.outlook.com
max_age: 1209600

Mail to our team still arrives over TLS whenever the sender supports it, because our MX (mail exchange) record points at Google's mail servers. Without a policy, though, no sender is told to refuse a plain connection.

To check your own domain, run the same dig lookups with your domain name. The NCSC's Check your cyber security service also tests a domain's email privacy: how well mail to it is protected in transit.

What UK GDPR says about email encryption

UK GDPR does not require email encryption, but it does require appropriate security, and the ICO names encryption as an example. Its encryption guidance says you should use it for personal information you store or send.

For data in transit, the ICO says you must not use any version of SSL, and should look for TLS, ideally version 1.3. It adds that the guidance is under review after the Data (Use and Access) Act.

This is a summary of ICO guidance, not legal advice. Marketing emails follow separate rules on consent and the soft opt-in under PECR (Privacy and Electronic Communications Regulations).

Is it safe to send bank details by email?

Your bank details on an emailed invoice usually travel under TLS, so interception is not the main risk. Fraud is: criminals impersonate a regular contact and ask for payment into a different account (NCSC).

A fraudster's email usually arrives over TLS too: Gmail requires a TLS connection from every sender, fraudsters included. To spot a forged sender, receiving servers check DMARC, which builds on the SPF and DKIM records a domain publishes. DMARC cannot catch a lookalike domain, or a real account that someone has taken over.

The NCSC suggests telling customers that your bank details will not change. It also advises confirming important email requests through a second channel, such as a phone call (NCSC phishing guidance, reviewed February 2024).

Call a number you already hold: one printed in the email belongs to whoever wrote it.

How to send a sensitive document by email

For a file with passport scans, payslips or health details, lock the file itself before it leaves:

1. Share a link where you can. The NCSC suggests sharing files through an access-controlled cloud account instead of attaching them, so the recipient has to sign in to open the file.
2. Otherwise, encrypt the file before attaching it. Use the password option in your document or archive software, with a long password.
3. Send the password another way. The ICO's example is a phone call once the recipient confirms the email arrived, and it says never to put the password in the same email.
4. Check the address before you send. The ICO fined Surrey County Council £120,000 under the previous law in 2011, after misdirected emails (ICO). One held an unprotected file with sensitive data on 241 people.

Encryption in transit cannot help once someone signs in to your mailbox. The NCSC's small organisations guide (reviewed July 2026) puts passkeys first. Where a service has none, it asks for a strong, unique password with 2-step verification.

Apply that to every service that holds customer data, including your email marketing account. In MailGraf, Sign-in code for new browsers is on by default. When you sign in from a browser it does not recognise, MailGraf emails you a 6-digit code first (Manage your profile and security).