====== Email Encryption ======

**Email Encryption** protects email communications from unauthorized interception, eavesdropping, and tampering. Because standard email protocols transmit messages in plain text by default, encryption is essential for ensuring confidentiality, data privacy, and compliance with security standards.

Email encryption operates at two main levels: **In-Transit Encryption** (protecting messages as they travel between servers) and **End-to-End Encryption (E2EE)** (protecting message content from the sender's device directly to the recipient's inbox).

----

===== 1. In-Transit Encryption (Transport Layer Security) =====

In-transit encryption protects email messages while they are actively being transmitted over network connections between mail clients, submission servers, and mail transfer agents (MTAs).

==== STARTTLS ====
STARTTLS is an extension for SMTP, IMAP, and POP3 protocols that upgrades an existing plain-text connection into a secure, encrypted **TLS (Transport Layer Security)** connection.

  * **Opportunistic TLS:** By default, mail servers attempt to use STARTTLS if supported by the receiving server. However, if the receiving server does not support TLS or if an attacker manipulates the handshake, communication falls back to unencrypted plain text.
  * **Enforced TLS (MTA-STS):** To prevent fallback attacks and active Man-in-the-Middle (MitM) interceptions, domain administrators deploy [[email:dns-configuration:mta-sts|MTA-STS]] to strictly enforce encrypted connections and validate server certificates.

==== Monitoring TLS Delivery ====
Domains enforcing in-transit TLS encryption use [[email:dns-configuration:tls-rpt|TLS-RPT]] to receive automated JSON reports detailing encryption successes, certificate errors, and handshake failures.

----

===== 2. End-to-End Encryption (E2EE) & Message-Level Security =====

While in-transit encryption secures server-to-server links, the email content itself remains unencrypted (and readable) while stored on intermediate mail servers. **End-to-End Encryption (E2EE)** encrypts the message payload at the origin so that only the holder of the corresponding private key can decrypt and read it.

^ Protocol ^ Key Management ^ Verification Mechanism ^ Primary Use Case ^
| **S/MIME** (Secure/Multipurpose Internet Mail Extensions) | Uses centralized Public Key Infrastructure (PKI) with Digital Certificates issued by trusted CAs. | Validated through Certificate Authority chains (X.509). | Corporate environments, enterprise compliance, and legal signatures. |
| **OpenPGP / PGP** (Pretty Good Privacy) | Uses decentralized public/private key pairs and the "Web of Trust." | Keys are exchanged directly or published to PGP keyservers. | Individual privacy, tech-savvy users, and open-source ecosystems. |

----

===== In-Transit vs. End-to-End Encryption Comparison =====

^ Feature ^ In-Transit (STARTTLS / MTA-STS) ^ End-to-End (S/MIME / OpenPGP) ^
| **Scope** | Server-to-Server / Client-to-Server transport. | End-User Client to End-User Client. |
| **Protection at Rest** | No (Stored in plain text on mail servers). | Yes (Encrypted on mail servers and disk). |
| **Metadata Protection** | Protects headers and content during transit. | Encrypts body and attachments (Headers remain visible). |
| **Ease of Deployment** | Configured at the server/DNS level (transparent to users). | Requires client software, key generation, and management. |

----

===== Verification & Diagnostics with Telenegar =====

Audit your email server's transport encryption capabilities using **Telenegar Tools**:

==== Using Telenegar Tools ====
  * **TLS & Port Security Audit:** Test your mail server's STARTTLS support, SSL certificate validity, and cipher suites with the [[tools:mailcheck|Telenegar Mail Check Tool]].
  * **MTA-STS & TLS-RPT DNS Verification:** Check if your domain's TLS security records are properly published using the [[tools:dnscheck|Telenegar DNS Check Tool]].

----

===== Related Documentation =====

  * [[tools:mailcheck|Telenegar Mail Check Tool]] — Diagnostic tool for email authentication and TLS transport encryption.
  * [[tools:dnscheck|Telenegar DNS Check Tool]] — Diagnostic tool for DNS record resolution and propagation.
  * [[email:dns-configuration:mta-sts|MTA-STS]] — Enforce mandatory TLS encryption for inbound mail traffic.
  * [[email:dns-configuration:tls-rpt|TLS-RPT]] — Receive automated failure reports for TLS transport errors.
  * [[email:dns-configuration:dkim|DKIM]] — Add cryptographic signatures to verify sender integrity.
  * [[email:security:spoofing|Email Spoofing]] — Prevent forgery of outbound mail identities.
  * [[email:security:phishing|Phishing]] — Protect users against credential theft and malicious content.