Skip to content
Life Security

Search the site

Find pages and sections.

Email security

Last updated:

Email is the oldest piece of the modern internet that most people still rely on, and it was designed when privacy wasn’t a concern. It’s also the key to almost everything else you own online, because other services send their password resets to it. That combination makes email security two problems: keeping messages private, and keeping the account itself safe.

This page explains who can read your email, why a forged sender address is so easy, what encryption can and can’t do, and how email accounts get taken over. It doesn’t recommend specific email providers. Those picks belong on a page with testable criteria.

What email is, in plain terms

When you send a message, your email program hands it to your provider’s server. That server passes it to the recipient’s provider, and the recipient’s program fetches it. Each hop is a computer run by someone, and each can in principle see and store the message. The system was built so that any provider can deliver to any other, without a central authority.

That design explains most of email’s weaknesses. Messages travel through intermediaries you didn’t choose. The address shown in the “From” line is just text the sender typed. And the information needed to deliver a message, such as who sent it and who gets it, has to be readable by the servers.

Who can read your email

There are three places a message can be exposed.

In transit. Mail moving between servers can be protected with Transport Layer Security (TLS), the same technology behind the padlock on websites. It only works when both providers support it. Google’s transparency report currently shows 98% of outbound and 99% of inbound Gmail traffic encrypted. That’s a big change from 2014, when Google reported that 40% to 50% of mail between Gmail and other providers wasn’t encrypted, and under 1% of mail to Comcast.net was. TLS protects the message between servers, not at either end.

At rest. Your provider stores your mail, usually in a form it can read, and so does the recipient’s provider. TLS does nothing about that. Providers also sometimes use third-party services to filter spam. This is the same logic as any account you keep with a company, and why privacy matters covers why the holder of information has power over it.

On your devices and in your account. Anyone who gets into your account or your unlocked phone can read it. This is the most common route in practice, as the section on account takeover below explains.

End-to-end encryption for email, and its limits

End-to-end encryption means only you and the recipient can read the message, not even the providers. For email it comes from add-on standards, mainly OpenPGP and S/MIME. Both require the recipient to have a key, and both need software and set-up that most people don’t use.

Three limits are worth knowing.

Metadata stays visible. The sender, recipient, date and typically the subject line have to remain readable so servers can deliver the message. Encrypting the body doesn’t hide who emailed whom and when. This is how the standards work, though we haven’t found a single authoritative page that lists every header, so treat the details as general.

Software flaws. In 2018, European researchers disclosed EFAIL, a set of attacks on OpenPGP and S/MIME. An attacker who had an encrypted message could alter it so that a vulnerable email program, when decrypting it and loading external content such as images in HTML mail, sent the plaintext to the attacker’s server. Fixes and advice followed: update your email software, and turn off HTML rendering and remote content, which Sophos recommended. Some commentators argued the flaw lay in specific implementations, not OpenPGP itself.

Friction. A message is only protected if the other person uses encryption too, and keeping private keys safe is your job. For one-to-one private conversations, most people are better served by an end-to-end encrypted messaging app than by encrypted email. For a specific need such as a source, a lawyer or a journalist, encrypted email can make sense, and the threat model decides it.

Why forged senders work, and what stops them

The “From” address in a message is just a field. Without checks, anyone can type your bank’s address into it. Three standards help receiving servers decide whether a message really came from the domain it claims.

  • Sender Policy Framework (SPF) lists the servers allowed to send for a domain.
  • DomainKeys Identified Mail (DKIM) adds a digital signature the receiver can verify.
  • Domain-based Message Authentication, Reporting and Conformance (DMARC) builds on both and tells receivers what to do with mail that fails.

These matter to you even though domain owners are the ones who set them up. In February 2024, Google and Yahoo began requiring senders of bulk mail to Gmail and Yahoo addresses to use SPF and DKIM, and senders of more than 5,000 messages a day to use DMARC. That squeezed out some forged mail aimed at their users. It doesn’t make every message safe. Attackers use look-alike domains that pass all the checks, and the checks say nothing about whether a sender is honest.

Phishing remains the main way email is used against people. The FBI’s Internet Crime Complaint Center (IC3) logged 191,561 phishing and spoofing complaints in 2025, the most of any type, and business email compromise, where criminals impersonate a trusted party to redirect payments, cost about $3 billion in reported losses. Those are US figures made of reports people chose to file. Common threats covers phishing in more detail.

Two habits help. Check the actual sending domain, not just the display name. And treat any message that pushes you to act fast on money or logins as suspect, and confirm through another route. The FBI also advises flagging messages where the reply address differs from the sender address, which is a common sign of fraud.

Tracking inside messages

Many commercial emails contain a tracking pixel, a tiny invisible image. When your email program loads it, the sender’s server learns that you opened the message, when, on what kind of device, and roughly where you are from your IP address. Proton, which sells privacy-focused email and has an interest in the numbers, says nearly half of all emails contain some kind of tracker. A separate Princeton study, as cited by others, found 70% of mailing list emails did.

You can limit this. Apple Mail’s Mail Privacy Protection loads remote images through Apple’s servers ahead of time, so senders don’t see your real IP address or whether you actually read the message. Many email programs let you block remote images until you ask. The cost is that some emails look broken until you load the images.

Your email account is the master key

If an attacker controls your email, they can reset the password on your bank, your shopping accounts and your social media. Protecting the account matters more than protecting any single message.

Attackers get in the usual ways: a password reused from another breach, a phishing page, or a stolen session. Once inside, a common move is to create inbox rules. In 2021 the FBI warned that criminals were setting up auto-forwarding rules in victims’ web-based email, often invisible in the desktop program, to copy messages to themselves and hide their activity. Rules can also move or delete security alerts, so you don’t see them. Because a rule can keep forwarding copies, simply resetting the password may not end the exposure.

Signs of a takeover include rules, filters or forwarding addresses you didn’t create, sent messages you don’t remember and password reset emails you didn’t request. If you suspect it, government cyber security advice recommends changing the password, removing unfamiliar rules and forwarding, telling your contacts not to trust recent messages from you, and turning on multifactor authentication. If you can’t get in, use the provider’s account recovery process quickly.

Two protections matter most. A long, unique password, which introduction to passwords covers, and a second login step, which multifactor authentication covers. One more detail from FBI-related guidance: older email protocols such as POP and IMAP can let attackers sidestep multifactor authentication on some accounts, so turn off any legacy access you don’t use.

What email is good for

Treat email as a postcard that also works as a master key. It’s good for notices, receipts and password resets, and for communicating with people who aren’t on any other channel. For conversations you want private, a messaging app with end-to-end encryption is usually the better tool. Account creation explains how email aliases can keep your main address out of every sign-up.

Where to start

These steps run from most to least useful.

  1. Give your email account a long, unique password, and turn on a second login step. A security key or authenticator app is stronger than text-message codes.
  2. Check your account settings for forwarding addresses, inbox rules and connected apps you don’t recognise, and remove them.
  3. Be sceptical of urgent messages about money, logins or deliveries. Confirm using a number or website you found yourself.
  4. Block remote images or turn on your email program’s tracking protection.
  5. Use encrypted email only if you have a specific need, and use a separate address for the accounts you can’t afford to lose.

How much of this you need depends on what the account protects, which threat modeling helps you judge.

Sources

Frequently asked questions