Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my understanding, most of email servers use SMTP/POP/IMAP over SSL to encrypt the email.
It supports encryption when client (UA) send email to server (MTA) and UA receive email from MTA. However, not so many MTAs can encrypt when they send email between MTA to MTA.
(is my understanding correct?)

e.g. send email to
[Alice's PC] --- encrypted (SMTPS) ---> [ server] --- NOT ENCRYPTED (SMTP) ---> [ server] --- encrypted (POPS or IMAPS) ---> [Bob's PC]

If my understanding is correct, why most email servers don't support SMTP over SSL between email servers?

I develop better (less complex) interface to enable email encryption with PGP/GPG, but these days I think it may be better to use SMTPS because PGP/GPG needs manual key signing to keep reliability.

share|improve this question

closed as not constructive by Kyle Jones, Baarn, Dennis, Ƭᴇcʜιᴇ007, BBlake Jan 16 '13 at 12:39

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

What has this to do with email encryption? email encryption means to me that the email is encrypted on its own... – Uwe Plonus Jan 16 '13 at 7:12
?? Sorry, I didn't understand what you mean... How "email is encrypted on its own"? In my understanding, email can be easily intercepted if you send email as plain text (without encryption). – phanect Jan 16 '13 at 7:23
Yes, but sending an encrypted email has nothing to do with the SSL/TLS encryption of the SMTP server. – Uwe Plonus Jan 16 '13 at 7:25
To make sure that you only receive mail over an encrypted channel on your SMTP server, you'll have to force using TLS. So, if the other party doesn't understand/support TLS, you won't receive your mail. If you allow a fallback to unencrypted communication, you achieved nothing. This is why people rather opt to encrypt the mail itself and send it over an unencrypted channel. – Oliver Salzburg Jan 16 '13 at 12:28
To clarify: "encrypted email" refers to encrypting the contents using something like PGP before you even send it to your outgoing mail server. That has the added advantage of keeping it secret from whoever runs your MTA. It does not refer to encrypting the email between MTAs; encryption is normally applied only at the ends, not in the middle. Note also that communication between UA and MTA often involves transmitting some form of password, which should be encrypted anyway. – cpast Jan 17 '13 at 3:42

Good question, I really haven't seen any figures for this. I'm not sure, but I think many large companies now support SSL/TLS for inbound and outbound SMTP ("MX" mail delivery). This is normally optional and can be negotiated via StartTLS on port 25. Most SMTP servers do not require server to server TLS, however, as it would mean many would not be able to receive mail from an MTA that does not support or is not configured for TLS.

Many email clients support TLS between the UA and MTA - either SMTP/IMAP over SSL or POP3 over SSL. I think gmail for example requires SSL/TLS for IMAP and POP3.

Regarding actual end to end email encryption, this is normally achieved using S/MIME or PGP. However, due to the complexities in setting this up and managing it, it has not seen wide-scale adoption.

share|improve this answer
Thank you. So my understanding for current state for email encryption. You mean server-to-server SMTPS is not supported in many servers because server software like postfix don't support it? If most of mail server support it, the problem will be solved? (Maybe I don't understand your answer correctly...) – phanect Jan 17 '13 at 4:41
Even when encryption is negotiated, usually no strict checking of the certificates is done because that would block all those servers with self-signed certs. But without strict checking a man-in-the-middle attack is easy (not to mention that a MITM might prevent STARTTLS by intervening the cleartext phase) – Hagen von Eitzen Nov 27 '15 at 12:25

Not the answer you're looking for? Browse other questions tagged .