Definition
Email certificate pinning is a security technique in which a mail client or sending server remembers the exact TLS certificate, or its public key, presented by a receiving server, and refuses to connect if a different certificate appears later. By binding a hostname to a specific certificate, pinning prevents an attacker from substituting a forged certificate and intercepting encrypted email, even if the forged certificate is signed by a trusted authority.
How It Works
Normally, a TLS connection is trusted if the server's certificate chains up to a trusted certificate authority. An attacker who compromises a certificate authority, or who obtains a valid certificate for a victim's hostname, can exploit this trust model. Pinning short-circuits it by comparing against a locally stored record of the expected certificate.
Pinning can take two forms:
| Method | What is pinned |
|---|---|
| Certificate pinning | The full certificate or its fingerprint |
| Public key pinning | The server's public key, allowing certificate renewal without changing the pin |
When a client connects, it checks the presented certificate against the pinned value. If they do not match, the connection is aborted before any message data is sent, defeating a man-in-the-middle attack.
Why It Matters for Email
Email is transferred between many servers, and a compromise at any hop can expose message content. Pinning raises the bar for attackers trying to intercept mail by presenting a fraudulent certificate. It is most relevant in these scenarios:
- Outbound sending servers connecting to a known receiving host.
- Mobile or desktop mail clients connecting to a fixed mail server.
- Gateway-to-gateway connections between two organisations.
However, pinning also carries operational risk. If a legitimate server replaces its certificate without the sender updating the pin, mail delivery fails. Pinning is therefore best applied to stable, well-controlled endpoints rather than the open internet, where servers rotate certificates frequently.
Pinning is distinct from opportunistic encryption; it is an added trust assertion layered on top of a normal email TLS handshake.
Example
A bank's outbound mail gateway pins the certificate of a partner financial institution's inbound server. When an attacker later attempts a man-in-the-middle attack using a stolen but valid certificate, the bank's gateway detects the mismatch and refuses to send, preventing disclosure of customer data.
Was this useful?
Related Glossary Terms
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
Frequently Asked Questions
No. TLS encrypts the connection and verifies the certificate against trusted authorities. Pinning adds a further check that the certificate matches a previously recorded value, protecting against forged certificates from compromised authorities.
Yes. If a receiving server renews its certificate and the sender does not update the pin, the connection is refused and mail cannot be delivered. This is why pinning requires careful management and is usually reserved for stable endpoints.
Generally no. Pinning is most appropriate for fixed, well-controlled endpoints such as a partner gateway or an internal mail server. Applying it broadly across the internet is impractical due to frequent certificate rotation.