Email confidentiality, clearly explained

Is your email really confidential?

A secure connection protects an email while it moves. It does not, by itself, prevent the servers along the way from processing its content.

Follow the message

Every connection is encrypted.

At first glance, everything looks reassuring. Send the simulated email to see what TLS protects—and what it does not.

All four connections use TLS

Your computer

TLS

Sending server

TLS

SMTP relay

TLS

Recipient server

TLS

Recipient

In practice

A normal email. Secured in transit. Visible inside the relay.

The same message, followed from its TLS settings to the copy processed by the cloud SMTP relay.

TLS is enabled

Incoming and outgoing connections both use SSL/TLS. The transport is encrypted before the message leaves the workstation.

Incoming and outgoing email settings using SSL/TLS — The account uses encrypted connections for both incoming and outgoing mail.

The message is written normally

No unusual workflow: the user writes and sends the email from a familiar desktop mail environment.

A confidential acquisition email being written in a desktop mail application — A standard message, written and sent as usual.

The relay processes the content

Inside the cloud SMTP relay, the sender, recipient, subject and message body are available to the service handling delivery.

The sender, subject and body of the email visible inside an SMTP relay — The same subject and body appear inside the SMTP processing chain.

This is the standard behaviour of hosted SMTP across the main cloud platforms: TLS secures the connections, while the messaging service processes the content.

Without specific countermeasures, operating your own mail server is the most direct way to keep that intermediary under your control.