What is S/MIME Encrypted Email?

S/MIME encrypted email uses digital certificates to encrypt message content and add digital signatures that help recipients verify the sender and detect changes.

S/MIME stands for Secure/Multipurpose Internet Mail Extensions. It is a widely supported standard for certificate-based email encryption and signing.

Unlike TLS, which protects a connection between email systems, S/MIME protects the message content itself. It can be a strong fit when both sides use compatible email software and have the necessary certificates.

This guide explains how S/MIME works, what it is good at, what deployment involves, and when another secure email approach may suit the communication better.

Contents

• Understanding S/MIME
• How S/MIME Works
• Benefits and Limitations of S/MIME
• S/MIME Use Cases
• Implementing S/MIME
• Alternative Email Protection Methods
• S/MIME: A Summary

Understanding S/MIME

S/MIME is an email standard built on the Cryptographic Message Syntax. The current IETF S/MIME 4.0 specification defines formats for encrypted, signed, and signed-and-encrypted MIME content.

Microsoft’s Exchange Online guidance describes the same two core services: encryption to protect message content and digital signatures to verify the sender.

In practical terms, S/MIME gives email users two separate capabilities:

• Message encryption: The sender uses the recipient’s public certificate to encrypt the message. The recipient uses the corresponding private key to decrypt it.
• Digital signatures: The sender signs with their private key. The recipient’s email software checks the signature using the sender’s public certificate, helping verify origin and reveal whether signed content has changed.

Signing and encryption are related but not identical. A signed message is not automatically confidential, and an encrypted message is not necessarily digitally signed.

S/MIME protects the MIME message content it is applied to. Normal routing information still has to remain available to email systems, so message-level encryption should not be treated as protection for every piece of email metadata.

How S/MIME Works

S/MIME relies on public-key infrastructure (PKI). Each participating user has a public key that can be shared and a private key that must be protected.

Encrypting an S/MIME Message

1. Obtain the recipient’s certificate: The sender’s email software needs the recipient’s public certificate, commonly from an organisational directory or a previously signed message.
2. Encrypt the content: The sending client encrypts the message for the intended recipient.
3. Decrypt at the recipient: The recipient’s compatible email software uses their private key to unlock the message.

This means the sender cannot simply encrypt to any email address. The recipient’s public certificate must be available first.

Digitally Signing a Message

1. Create the signature: The sender’s private key is used to generate a digital signature for the message.
2. Check the certificate: The recipient’s client validates the certificate chain and uses the public key to check the signature.
3. Show the result: Compatible software indicates whether the signature is valid and whether signed content appears to have changed.

A valid digital signature provides useful assurance, but it still depends on the certificate being issued and managed correctly, the private key remaining under the right person’s control, and the recipient trusting the certificate chain.

"Implementing S/MIME is like adding a secure seal to every email - this helps to make sure only the right eyes see your message."

Michael Wakefield, CTO, Beyond Encryption (Mailock)

Certificate authorities and organisational PKI services help bind public keys to identities. Administrators also need processes for trust, renewal, revocation, recovery, and secure private-key handling.

Benefits and Limitations of S/MIME

S/MIME is a credible standards-based option, particularly in managed environments. Its value comes with operational requirements that should be considered before rollout.

What S/MIME Does Well

• Message confidentiality: Encrypted content remains unreadable without the corresponding recipient private key.
• Sender and integrity assurance: Digital signatures help recipients verify the certificate used to sign the message and detect changes to signed content.
• Standards-based interoperability: S/MIME can work across compatible clients and organisations that use trusted certificate infrastructure.
• Message-level protection: The content stays encrypted beyond the server-to-server connection protected by TLS.

What S/MIME Requires

• Certificates for participating users: Senders and recipients need the right certificates, keys, and compatible software.
• Public-key availability: A sender needs each recipient’s public certificate before encrypting the message.
• Lifecycle management: Certificates expire, private keys can be lost or compromised, and trust or revocation data must remain current.
• Client and policy testing: Support varies by email client, version, device, administrator policy, and the way other protection technologies are configured.

Encrypted content can also affect malware scanning, search, archiving, eDiscovery, and recovery workflows if those systems cannot access the necessary keys. Endpoint compromise remains a separate risk because authorised software must eventually decrypt the message for the user.

S/MIME digital signatures can help recipients recognise authentic signed mail, but they do not prevent phishing or spoofing across email as a whole. Unsigned or incorrectly trusted messages still require normal security checks.

S/MIME Use Cases

S/MIME is often most practical where the sender and recipient population is known and certificate management can be governed.

Managed Internal Communications

An organisation can issue certificates to employees, publish public certificates through a directory, and configure supported clients centrally. This can make signing or encrypting selected internal messages more repeatable.

Established Partner Networks

Two organisations with compatible PKI and certificate-exchange processes can use S/MIME for sensitive business-to-business email without relying on a shared secure portal.

Messages Requiring Digital Signatures

S/MIME is useful where recipients need a cryptographic signal about who signed the content and whether the signed message has changed.

Controlled Mobile Deployments

Supported mobile email apps can use S/MIME when certificates and policies are delivered correctly. For example, Apple Mail on iOS supports S/MIME and requires the recipient’s public certificate for encrypted sending.

For broad external customer communication, certificate exchange may be the deciding factor. If recipients are not already part of the certificate environment, another protected delivery model may be easier to operate.

Implementing S/MIME in Your Organisation

A successful rollout needs more than switching on an email-client setting. Treat S/MIME as a managed identity, certificate, and support programme.

1. Define the Communication Scope

Identify which users, recipients, and message types need signing, encryption, or both. Avoid applying S/MIME to every message unless the recipient and operational requirements support it.

2. Choose the Certificate and Key Model

Decide how certificates will be issued, validated, stored, backed up, recovered, and revoked. Certificates may come from an organisational service or a trusted certificate authority.

3. Publish and Exchange Public Certificates

Make public certificates available through a directory or signed-message exchange. Confirm how external partners will update certificates when keys change.

4. Configure Supported Email Clients

Test the exact clients and versions in use. Microsoft’s current Outlook S/MIME setup guidance covers new Outlook, classic Outlook, and Outlook on the web, with different configuration requirements.

For Gmail, hosted S/MIME is limited to supported Google Workspace editions and must be enabled by an administrator. Google also documents certificate upload and public-key exchange requirements.

5. Manage the Certificate Lifecycle

Set clear processes for renewal, revocation, private-key compromise, staff departures, key recovery, and access to historic encrypted mail.

6. Train and Support Users

Show users how to recognise valid signatures, respond to certificate warnings, exchange signed messages, and handle recipients who are not ready for S/MIME.

"Proper configuration of email clients is the linchpin in S/MIME deployment - it bridges the gap between security and usability."

Carole Howard, Head of Networks, Beyond Encryption (Mailock)

Before rollout, test signing, encryption, key loss, certificate renewal, revoked certificates, external recipients, mobile clients, archive access, and interactions with other message-protection policies.

Alternative Email Protection Methods

S/MIME is one part of the secure-email landscape. The right choice depends on what needs protecting and how recipients should access the message.

Microsoft 365 users can learn more about the difference between its service-managed option and certificate-based S/MIME in Does Microsoft Outlook Use Email Encryption?

Where Mailock Fits

Mailock gives teams a purpose-built way to protect sensitive external email and guide each recipient through controlled access, without asking every customer to join the same certificate environment.

With Mailock, senders can choose a configured recipient check, invite secure replies, use Message Tracker to see when protected content has been accessed, and use Message Revoke to close future access when circumstances change.

Teams can protect individual messages through supported sending routes, including Mailock for classic Outlook on Windows and the Mailock web app. Organisations can also automate higher-volume secure delivery through integrations.

S/MIME remains valuable when peer-to-peer certificate interoperability and digital signatures are central to the requirement. Mailock is designed for the sensitive customer journey, where access, response, follow-up, and post-send control need to work together.

Mailock can sit alongside Microsoft 365 or another email platform, adding a consistent secure customer journey where that specialist workflow is useful.

S/MIME: A Summary

S/MIME is a recognised standard for certificate-based email encryption and digital signatures. It can provide strong message confidentiality, sender assurance, and integrity checking when certificates, keys, clients, and trust are managed correctly.

Its main operational consideration is that both sides need compatible S/MIME setup and the sender needs the recipient’s public certificate. Certificate lifecycle and user support are part of the solution, not optional administration around it.

Choose S/MIME for managed PKI and peer-to-peer signing or encryption requirements. Consider Microsoft Purview Message Encryption for Microsoft-managed external sharing, or Mailock when sensitive customer communications need configurable recipient checks, secure replies, access visibility, revocation, and individual or automated delivery.

FAQs

What Does S/MIME Mean in Email?

S/MIME stands for Secure/Multipurpose Internet Mail Extensions. It is a standard for digitally signing and encrypting MIME email content using certificates and public-key cryptography.

Does S/MIME Encrypt Attachments?

Yes. Attachments included within the protected MIME content are encrypted with the message. Email routing information and other metadata needed to deliver the message are not all hidden by S/MIME.

Should I Turn On S/MIME for My Emails?

Turn it on when your organisation has a defined signing or encryption requirement, compatible clients, managed certificates, and a practical way to obtain recipient public certificates. It is not automatically the best route for every email or external recipient.

What Are the Disadvantages of S/MIME?

S/MIME requires certificate issuance, public-key exchange, compatible client configuration, renewal, revocation, recovery, and user support. It can also complicate inspection, search, archiving, and access to historic mail if key management is not designed carefully.

Does Gmail Support S/MIME?

Yes, on supported Google Workspace editions. An administrator must enable hosted S/MIME, add or allow certificates, and support key exchange. Check Google’s linked administrator guidance for the current list of eligible editions.

How Do I Get an S/MIME Certificate for Outlook?

Follow your organisation’s certificate process or obtain a suitable digital ID from a trusted certificate authority. Install or import it using the instructions for your Outlook version, then make sure the public certificates for intended recipients are available.

Is S/MIME End-To-End Encryption?

S/MIME is commonly described as peer-to-peer or end-to-end message encryption because content is encrypted for the recipient’s key and decrypted by compatible recipient software. Use the label carefully: key custody, hosted implementations, endpoint security, certificate trust, and unencrypted routing metadata still affect the overall security model.

How Is S/MIME Different From Microsoft Purview Message Encryption?

S/MIME uses user certificates and public-key exchange for standards-based signing and encryption. Microsoft Purview Message Encryption is a Microsoft 365 service that manages encrypted email access and rights through supported Outlook experiences or an encrypted-message portal.

References

S/MIME Version 4.0 Message Specification, Internet Engineering Task Force, 2019

Set Up Outlook to Use S/MIME Encryption, Microsoft, 2026

S/MIME for Message Signing and Encryption in Exchange Online, Microsoft, 2024

Email Encryption in Microsoft 365, Microsoft, 2026

Turn On Hosted S/MIME for Message Encryption, Google, 2026

Use S/MIME to Send and Receive Encrypted Messages in the Mail App in iOS, Apple, 2024

Reviewed by

Sam Kendall, 16.07.26

This content is for general information only and is not legal advice.