TLS or end-to-end encryption in e-mail: what each one protects, and when you need it

Comparisons and alternatives·· 61 views· 3 min read

The short answer: TLS encrypts the message on the way: between your device and our server, and between servers when both sides accept it. Once delivered, the message sits readable in the sender’s and the recipient’s mailboxes. End-to-end encryption (S/MIME or OpenPGP) encrypts the content, so only the recipient can open it, but both sides have to set it up. For everyday mail TLS is enough; for sensitive documents, consider end-to-end or a simpler alternative.

What each one protects

Kind What it protects What it does not protect
TLS between your device and our server Your password and messages in transit, for example on public Wi-Fi. It is on when the app uses SSL/TLS or STARTTLS. The message stored on the server and on the device.
TLS between our server and the recipient’s The hand-over from one server to the other, when both accept an encrypted connection. It does not depend only on us or on you: it also depends on the recipient’s server. And the copy kept there is readable.
S/MIME The content and attachments, with a certificate per person. It can also sign, to prove who sent it. The subject, sender, recipients and dates usually stay visible. Both sides need a certificate.
OpenPGP The content and attachments, with a key pair per person. The same as S/MIME, and every recipient needs their public key exchanged beforehand.
Password-protected file The attached document, if the password travels by another channel. The e-mail text, and the subject.

What to do in practice

1 Make sure every app uses an encrypted connection: IMAP on 993 with SSL/TLS, SMTP on 465 with SSL/TLS or on 587 with STARTTLS. Never choose “None” for security. See SMTP ports 465, 587 and 25.
2 Open webmail only at its https address, with the padlock in the browser: how to access your webmail.
3 For sensitive documents, weigh up end-to-end. Both sides need certificates or keys, and programs that use them: Outlook, Apple Mail and Thunderbird support S/MIME, and Thunderbird includes OpenPGP. In webmail and on phones, support varies.
4 The simple alternative: send the document as a password-protected file and give the password by another channel, by phone or by message.
5 If you use end-to-end, keep the private key or certificate somewhere safe. Without it, old encrypted messages no longer open, not even for you.
The padlock does not make a message secret forever. Once delivered, it sits readable in the recipient’s mailbox and on every device that syncs it. Do not send passwords, card data or identity documents by e-mail just because the connection is encrypted. And be wary of messages asking for them: how to recognise phishing.
A protected file plus the password by another channel covers most cases without either side installing certificates.

Not sure your app is using an encrypted connection? Tell us which one you use and send a screenshot of the account settings, without the password.

Open a support ticket

SEE ALSO

SMTP ports 465, 587 and 25: SSL, STARTTLS and which one to use

How to access your webmail

How to recognise a phishing e-mail or message, and what to do if you clicked

Your e-mail account has been hacked: what to do in the first hour

Keeping your own copy of your e-mail: how to back up a mailbox

The Gmail app or the Outlook app for your domain mailbox: phone and computer compared

RECOMMENDED PRODUCT

Professional e-mail on your domain

Mailboxes in your company name, no adverts, with spam filtering. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Comparisons and alternatives 907 Hostinger in Mozambique: what it offers, what it leaves out, and alternatives By the MozOut editorial team · Updated 15 October 2026 · Data from the providers' public pages, consulted in October 202...
Comparisons and alternatives 941 Hostinger or MozOut: which to choose for a website in Mozambique By the MozOut editorial team · Updated 15 October 2026 · Data from the providers' public pages, consulted in October 202...
Comparisons and alternatives 1,345 Can you register a .mz domain with an international provider? How to check before paying It is a fair question: you found cheap international hosting and want to know whether you can register your .co.mz there...
Comparisons and alternatives 1,120 Google Workspace or Professional E-mail: what changes for a Mozambican company Google Workspace is a good product - saying otherwise would be dishonest. The real question is different: are you buying...
Comparisons and alternatives 1,183 Hosting providers in Mozambique: what to compare before deciding By the MozOut editorial team · Updated 15 October 2026 · Data from the providers' public pages, consulted in October 202...
Comparisons and alternatives 1,570 Registering a .mz: with CIUEM, through a reseller, or with us? By the MozOut editorial team · Updated 15 October 2026 · Data from the providers' public pages, consulted in October 202...