# What is Email Encryption?

> Email encryption is the use of cryptography to protect email from unauthorized reading while it is transmitted, stored, or carried as protected message content.

- Canonical URL: https://yellowcube.eu/glossary/email-encryption/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Transport encryption secures a connection between particular systems, while end-to-end content encryption lets intended participants protect the message body and attachments across intermediate mail services. The assurance depends on where encryption starts and ends.

Transport Layer Security (TLS) commonly protects mail-server and client connections. Secure/Multipurpose Internet Mail Extensions (S/MIME) and OpenPGP can protect message content for intended recipients, while provider-managed encryption at rest covers a different exposure. Selection should follow the threat model and interoperability needs.

### Key points

- **Protection scope:** Identify whether the risk concerns a network hop, intermediary mail service, stored mailbox, archive, recipient endpoint, or content forwarded beyond the original system.
- **Keys and recipients:** Validate recipient identities, protect private keys, define trust and certificate rules, support revocation and rotation, and prevent silent delivery when required assurance is absent.
- **Operations and recovery:** Plan enrollment, multiple devices, search and archiving, malware handling, legal retention, account recovery, key loss, and secure access for authorized investigations.
- **Important limitation:** Content encryption may expose addressing, timing, routing, and sometimes subject metadata; it cannot protect a compromised endpoint or stop an authorized recipient from exporting content. TLS protects negotiated connections, not every later hop or mailbox.

### Related terms

[Email security](<https://yellowcube.eu/glossary/email-security/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [DomainKeys Identified Mail (DKIM)](<https://yellowcube.eu/glossary/domainkeys-identified-mail/>) · [Public key infrastructure (PKI)](<https://yellowcube.eu/glossary/public-key-infrastructure/>) · [Data loss prevention (DLP)](<https://yellowcube.eu/glossary/data-loss-prevention/>) · [Pretty Good Privacy (PGP)](<https://yellowcube.eu/glossary/pretty-good-privacy/>)

### Sources

[NIST SP 800-177 Rev. 1, Trustworthy Email](https://csrc.nist.gov/pubs/sp/800/177/r1/final) · [RFC 9787, Guidance on End-to-End Email Security](https://www.rfc-editor.org/info/rfc9787) · [RFC 8551, S/MIME Version 4.0 Message Specification](https://www.rfc-editor.org/info/rfc8551/) · [RFC 9788, Header Protection for Cryptographically Protected Email](https://www.rfc-editor.org/info/rfc9788/) · [RFC 9580, OpenPGP](https://www.rfc-editor.org/info/rfc9580/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.