Protect your domain and your recipients from abuse: phishing and spoofing defense, email encryption, TLS, S/MIME, and secure delivery. Practical, standards-based explanations of how email security works and how to configure it correctly.
S/MIME vs PGP for email encryption — the short answer: choose S/MIME if you are an organisation that needs native Outlook and Apple Mail support, compliance, and central key recovery; choose PGP if you are an individual who wants zero cost, no Certificate Authority, and sole control of your keys. Both deliver end-to-end email encryption … Read more
How to encrypt email with PGP (quick version): (1) pick a tool — Thunderbird has OpenPGP built in, while Gmail, Outlook.com and Yahoo need the Mailvelope browser extension (there is no native OpenPGP in Gmail or Outlook); (2) generate a PGP key pair (an Ed25519 key is the 2026 default); (3) publish your public key … Read more
How to set up S/MIME in Outlook (quick version): (1) get an S/MIME certificate from a CA as a password-protected .pfx file; (2) double-click the .pfx to import it into the Windows certificate store; (3) in classic Outlook open File → Options → Trust Center → Trust Center Settings → Email Security, click Settings under … Read more
Is email encrypted in transit? Usually yes — modern mail travels between servers over TLS. But two caveats matter: standard TLS is opportunistic, so an attacker can silently strip it and force the message into plain text, and even when TLS holds, the servers at each end can still read the content. To make transit … Read more
How to prevent email phishing attacks: no single control is enough, so layer them. (1) Authenticate your own domain with DMARC at p=reject so criminals can’t send phishing that looks like it is from you; (2) filter inbound mail through a secure gateway; (3) enforce multi-factor authentication so a phished password alone can’t take over … Read more
How to stop email spoofing of your domain: you can’t stop an attacker from typing your domain into a From field, but you can make receiving servers reject the forgery. Publish an SPF record listing your legitimate senders, enable DKIM signing, then deploy DMARC and move it to p=reject (with sp=reject for subdomains). At enforcement, … Read more