Definition
Email encryption protects the content of email messages from unauthorised access during transmission and, in some implementations, at rest. The most widely used encryption mechanism for email in transit is Transport Layer Security (TLS), implemented through the STARTTLS command in SMTP. When both the sending and receiving mail servers support STARTTLS, the connection between them is encrypted, preventing interception of message content during transmission between email infrastructure providers. According to Google's Transparency Report, as of 2025, 97 per cent of inbound email to Gmail and 96 per cent of outbound email from Gmail is encrypted with TLS during transport. However, TLS only protects the message while it is moving between mail servers — once the message arrives at the recipient's mailbox provider, it may be stored unencrypted.
End-to-end encryption for email, where only the intended recipient can decrypt the message content, remains rare in marketing and general business email usage. Pretty Good Privacy (PGP) and S/MIME (Secure/Multipurpose Internet Mail Extensions) provide true end-to-end encryption by encrypting the message body on the sender's device such that only the recipient's private key can decrypt it. However, these technologies face significant adoption barriers: both sender and recipient must manage cryptographic keys, PGP key management is complex for non-technical users, and encrypted email cannot be scanned by spam filters or security gateways. According to the 2024 Email Security Survey by Mimecast, only 6 per cent of organisations use PGP or S/MIME for any business email communications, and usage in marketing email is negligible.
Compliance requirements drive encryption adoption in specific industries. The Health Insurance Portability and Accountability Act (HIPAA) in the United States requires that protected health information transmitted via email be encrypted, with covered entities and business associates facing penalties of $100 to $50,000 per violation. The General Data Protection Regulation (GDPR) does not explicitly mandate encryption but Article 32 requires "appropriate technical and organisational measures" to protect personal data, and encryption is recognised as an appropriate measure by the European Data Protection Board. For email marketers, encryption affects tracking capabilities — encrypted messages can interfere with open tracking pixels, click tracking redirects, and personalisation tokens because some encryption methods can alter or block dynamic content elements within the message body.
Best Practices
Enable TLS for all email sending infrastructure and verify that your ESP or sending platform supports mandatory TLS (also called forced TLS or TLS enforcement), which rejects the connection if the receiving server does not support STARTTLS. While opportunistic TLS (sending encrypted if available but falling back to plain text) is the default, mandatory TLS provides stronger protection by ensuring that no messages are transmitted in plain text.
Implement BIMI (Brand Indicators for Message Identification) alongside your encryption and authentication configuration. BIMI requires DMARC enforcement and allows recipients' mail clients to display your verified brand logo, providing visual assurance to subscribers that the email content has not been altered since it was signed by your DKIM key. This cryptographic chain — DKIM signing verifying message integrity, TLS protecting transport, BIMI providing visual verification — creates a comprehensive trust framework.
Avoid using PGP or S/MIME encryption for marketing emails. These encryption methods prevent spam and security scanning by receiving infrastructure, causing marketing messages to be blocked or quarantined. PGP-encrypted marketing emails will not pass spam filters, authentication checks will fail on encrypted content, and the subscriber experience is poor because most email clients require additional software or plugins to decrypt PGP messages.
For compliance-required encryption — such as when a financial services email contains account-specific information that qualifies as personal data — use secure portal delivery rather than encrypted email. Send a plain-text notification email with a link to a TLS-secured web portal where the subscriber can view the information after authenticating. This approach satisfies compliance requirements without triggering the deliverability and usability problems associated with encrypted email content.
Monitor your TLS reporting through your email infrastructure provider's delivery logs and through Google Postmaster Tools and Microsoft SNDS, which both report TLS connection statistics for your outgoing mail. A decline in TLS-encrypted delivery percentage may indicate that a receiving provider has changed its TLS configuration or that your sending infrastructure has a STARTTLS compatibility issue that needs investigation.
Related Glossary Terms
DMARC Alignment
DMARC identifier alignment determines whether the domain in the From header matches the domains used in SPF and DKIM authentication. Strict or relaxed.
Australia Spam Act
Australia's Spam Act 2003 regulates commercial electronic messages including email. It requires consent, functional unsubscribe mechanisms within 5 working days, and sender identification. Penalties reach AUD $2.22 million per day.
Email CASL
Canada's Anti-Spam Legislation requirements for commercial electronic messages, including consent types, record-keeping, and penalties up to $10 million per violation.
Email CCPA
California Consumer Privacy Act requirements for email marketing, including consumer rights to access, delete, and opt out of data collection and sale.
Email Consent Record
Email consent record-keeping captures proof of opt-in including timestamp, IP address, method, and exact wording shown. GDPR requires controllers to demonstrate consent upon request.
Email DANE
DANE (DNS-based Authentication of Named Entities) uses TLSA records to authenticate STARTTLS connections for SMTP, preventing TLS downgrade and man-in-the-middle attacks. It requires DNSSEC to function securely.
Frequently Asked Questions
TLS encrypts the connection between mail servers during message transport, protecting the content while in transit. End-to-end encryption (PGP or S/MIME) encrypts the message content on the sender's device such that only the intended recipient can decrypt it, protecting the content at rest on the mail server as well.
TLS provides transport security between the sending and receiving mail server. It does not protect the message after it reaches the recipient's mailbox, where it may be stored unencrypted. TLS also only works if both servers support STARTTLS — approximately 3 to 4 per cent of email delivery paths remain unencrypted.
End-to-end encryption (PGP/SMIME) can break open tracking pixels and click tracking redirects because the encrypted content cannot be processed by intermediate systems. TLS encryption does not affect tracking because the tracking elements are visible within the message body that TLS protects during transport.
GDPR does not explicitly mandate encryption but Article 32 requires appropriate technical measures to protect personal data. Encryption is recognised by the EDPB as an appropriate measure. Whether encryption is strictly required depends on the nature of the personal data, the processing context, and the risk assessment.
PGP encryption is not recommended for marketing email. Encrypted marketing messages will be blocked by spam filters, cannot be scanned for security threats, and require recipients to have PGP software configured, which virtually no marketing email subscribers have. Use TLS for transport security and secure portals for compliance-required content protection.