Transport encryption secures a connection between particular systems, while end-to-end content encryption lets intended participants protect the message body and attachments across intermediate mail services. The assurance depends on where encryption starts and ends.
Transport Layer Security (TLS) commonly protects mail-server and client connections. Secure/Multipurpose Internet Mail Extensions (S/MIME) and OpenPGP can protect message content for intended recipients, while provider-managed encryption at rest covers a different exposure. Selection should follow the threat model and interoperability needs.
Key points
Protection scopeIdentify whether the risk concerns a network hop, intermediary mail service, stored mailbox, archive, recipient endpoint, or content forwarded beyond the original system.
Keys and recipientsValidate recipient identities, protect private keys, define trust and certificate rules, support revocation and rotation, and prevent silent delivery when required assurance is absent.
Operations and recoveryPlan enrollment, multiple devices, search and archiving, malware handling, legal retention, account recovery, key loss, and secure access for authorized investigations.
Important limitationContent encryption may expose addressing, timing, routing, and sometimes subject metadata; it cannot protect a compromised endpoint or stop an authorized recipient from exporting content. TLS protects negotiated connections, not every later hop or mailbox.