Check which part of an email’s journey is encrypted

Fastmail explains how email encryption protects different parts of a message’s journey. TLS protects a connection, while disk encryption protects stored media using keys the provider may hold. End-to-end encryption aims to restrict message reading to the participants. These boundaries matter: encrypted storage does not by itself prevent a running mail service from reading messages.

Fastmail · Neil Jenkins · Dec 17, 2025

Why it matters

Asking who holds the keys gives a clearer security requirement than asking whether email is encrypted.

More context

This December 2025 explanation also covers server-to-server delivery: opportunistic TLS can permit unencrypted fallback, while policies such as MTA-STS can require an authenticated encrypted connection. Map the specific threat and delivery hop before evaluating a provider’s claim.

Keep in mind

This is a provider-authored explanation, not an independent audit of any service. Features and protection differ across implementations; encryption also does not prevent every form of account compromise.

Original read