Email Encryption FAQ Why is encryption important in transit? Encryption in transit helps protect your email from snooping when emails are sent or received between you and your intended recipients. Unfortunately, millions of unencrypted emails are sent and received daily with "no security", which are the main targets of covert tampering and mass surveillance through dozens of optical fibers and routers. If my email is encrypted in transit, does that mean that no one can ever peep into my email? Security is an ongoing challenge where no solution is perfected and progress is incremental. Encryption in transit makes it more difficult to snoop on email, and universal encryption of email in transit will be a major step towards online security and privacy. But encryption does not make snooping impossible. In addition, emails are not only unsafe in transit — they can also be snooped on once delivered. For example, by installing malware on a computer you use to read email, unauthorized parties can still access your email. What does email encryption mean in transit o? When an email is encrypted in transit, it means that it cannot be read by anyone who has access to the network from which the email passes while moving from the sender to the destination. You can see this as a temporary cover of security in which your email is kept private while sending it to the intended recipient. Transport Layer Security (TLS) is the standard means of encryption in transit for email. TLS does not encrypt inactive data — that is, it does not encrypt email stored in a server. There are several ways to do this, such as using PGP (see below). Is TLS the best solution for keeping my email in transit? No single Internet security solution is accurate, but not encrypting email is a huge risk. Encrypting email when exchanging between email providers is a major improvement that can be implemented very easily without causing any inconvenience to users. Some more information about the status and flow of TLS for email can be seen in this detailed blog post on Facebook. Is email sent by Google users to other Google users encrypted in transit? Yes This includes notifications from Gmail, Google Apps and Google+. That's why this report focuses only on email deliveries in which Google is one of only two providers involved. How does encryption in transit relate to HTTPS access to Gmail? HTTPS is used by default when signing in to Gmail since 2010. This means that your email is encrypted and secure while traveling between Google's data centers and the computer you use to read email. This report is about a different topic: whether your email is protected with TLS when you go outside Google's data centers to the external mail server of the person you're emailing. We have automatically turned on HTTPS for Gmail, but when emails are sent between different mail providers, it is necessary to provide TLS from both providers to encrypt the email in transit. How does encryption in transit relate to other forms of email encryption, such as PGP? PGP encrypts the content of your email in such a way that if you do everything exactly, no one but you and the intended recipient will ever see it. For example, when a Gmail user receives an email encrypted with PGP, Gmail is unable to index it for later searching because Gmail cannot view the content. This dilemma of additional security features makes it particularly appropriate for those at risk and adds an extra layer of protection that does not provide encryption in transit. But encryption in transit adds a significant privacy benefit to PGP. PGP encrypts only the contents of your email, not its headers (for example, who is sending and receiving email). A person who "knows by chance" the delivery of an email encrypted with a PGP will be able to see at which address the message was sent, but will not be able to see the message's contents. But when the PGP-encrypted message is also encrypted with TLS while in transit, the sender and receiver of the message will not be visible to anyone with a bad intent. Why are all emails going to and from Gmail not encrypted in transit? For decades, by default email has been exchanged over the Internet with no encryption — as if it were written on a postcard. Gmail is able to encrypt its sent and received email, but only if the other email provider supports TLS encryption. In other words, 100% encryption of all emails on the Internet requires the cooperation of all online mail providers. What is being calculated in this report? We count the recipients of the message, not the SMTP connection. We do not count emails that our systems flag as spam. We do not count messages from hosts whose forward or reverse DNS is unavailable or uneven. This is done to ensure that incoming messages can be meaningfully distinguished, as a message sender can enter any "sender" address they wish. What does "X through Y" mean?