TLS Email Encryption Explained - How To Encrypt Email with TLS

It is no secret that email is the preferred method of communication for businesses - a trend that has only been magnified with the increase in remote workers brought on by the pandemic. That being said, email is effectively a plaintext communication sent from email clients to receiving email servers or from one server to another, leaving the content of messages in transit vulnerable to compromise without additional protection via encryption technology such as the Transport Layer Security (TLS) standard.

Learn how TLS works to help secure email communications, and how to securely implement TLS in the Postfix open-source mail transfer agent (MTA) to help fortify email against spoofing and data theft.

TLS Basics: What is Transport Layer Security (TLS)?

Transport Layer Security (TLS) is a cryptographic protocol that offers end-to-end encryption technology for messages “in transit” from one secure email server that has TLS enabled to another,  helping to protect user privacy and prevent eavesdropping or content alteration. TLS is the successor protocol to SSL. It works in much the same way as the SSL, using encryption to protect the transfer of data and information. TLS is an Internet Engineering Task Force (IETF) standard protocol that provides authentication, privacy and data integrity between two communicating computer applications. For optimal security and privacy of message content, TLS is required between all servers handling email communications (including hops between internal and external servers). It is recommended that all clients and servers insist on mandatory usage of TLS in their email communications - preferably the most recent version, TLS 1.3.

TLS is used by leading email providers and ISPs including Google, Microsoft, Yahoo and Comcast, and is also used to secure web communications via HTTPS.

How Does TLS Help Secure Email Communications?

TLS secures email communications by encrypting messages from mail server to mail server, making it more difficult for hackers to intercept and read messages. The TLS protocol uses a combination of symmetric cryptography - where data is encrypted and decrypted with a secret key known to both sender and recipient - and asymmetric cryptography - which uses a public and private key pair to encrypt and decrypt data - to maintain a balance between performance and security. TLS supports the use of digital certificates to authenticate receiving servers (authentication of sending servers is optional), helping to prevent email fraud and data compromise by verifying that receivers (or senders) are in fact who they claim to be. “Opportunistic TLS” describes a scenario in which TLS is used by both sending and receiving parties to negotiate a secured session and encrypt a message, and represents the most secure implementation of the TLS protocol.

The widely used open-source Postfix mail transfer agent (MTA) - which has earned a reputation of being highly secure - can be configured to support TLS, giving Postfix users the ability to encrypt mail and to authenticate remote SMTP clients or servers. 

Get simplified instructions on how to configure TLS for Postfix configuring ssl tls for postfix 5c87cb54aa89.

Summary

Using and enforcing the use of TLS in your email communications must be viewed as an important part of a defense-in-depth approach to securing business email and protecting sensitive information.TLS is used by almost all leading email providers and ISPs; however, the protocol must be properly set up and configured to provide optimal security. In this article, you learned the basics on implementing TLS to help secure against sender fraud and data compromise. If you are would like further details, or have additional questions, please comment below. We'd love to help!

This article was originally published on the Guardian Digital blog.