Email security is not a single technical standard but a spectrum of protections designed to mitigate specific threats. For most users, the primary risks involve account compromise through phishing, malware, or accidental deletion. However, for high-stakes users like journalists or activists, the threat model expands to include network eavesdropping, data breaches, and legal compulsion by governments. Choosing an encryption method depends on which of these threats a user prioritizes and which trade-offs they are willing to accept.
The first layer of protection is encrypting the connection between a user's device and their email provider. This is typically handled by Transport Layer Security (TLS), with the modern TLS 1.3 standard ensuring that data is encrypted while in transit over local Wi-Fi or ISP networks. To ensure the user is connecting to the legitimate provider rather than an imposter, Public Key Infrastructure (PKI) uses certificates signed by trusted Certificate Authorities. This system is further bolstered by Certificate Transparency (CT) logs, which provide public records of issued certificates to help detect fraudulent activity. While this secures the path to the provider, it does not necessarily protect the content of the email once it reaches the server.
When an email travels between different providers, it often relies on "opportunistic TLS," where servers attempt to establish an encrypted connection but fall back to unencrypted delivery if the receiving server does not support it. This creates a vulnerability to man-in-the-middle (MITM) attacks, where an adversary can strip the encryption command. To address this, protocols like MTA-STS and DANE have been developed. MTA-STS allows domains to declare a requirement for encrypted connections, while DANE uses cryptographically-signed DNS records (DNSSEC) to verify certificates. However, many providers, including Fastmail, favor MTA-STS over DANE because DNSSEC carries a high risk of availability issues; errors in DNSSEC can cause mail delivery to fail for hours or days, a trade-off that many providers find unacceptable compared to the confidentiality benefits of DANE.
Beyond transit, providers use encryption at rest to protect data stored on physical disks against theft or hardware decommissioning. While this protects against physical breaches, the provider still holds the keys, meaning they can comply with legal requests or be compromised if their internal systems are breached. In contrast, "zero-access encryption" ensures that the provider never holds the keys, as they are derived from the user's password on their own device. While this protects against insider threats and government compulsion, it introduces significant usability hurdles: it can break standard search capabilities, prevent the use of standard IMAP/JMAP protocols, and creates a situation where a lost password results in permanent data loss. Finally, true end-to-end encryption (E2EE) via S/MIME or OpenPGP ensures only the sender and recipient can read a message. Despite its high security, E2EE has struggled with consumer adoption because of the immense complexity involved in key distribution, rotation, and the fact that many users find it difficult to verify public keys correctly.