is my email encrypted email encryption check email encryption TLS email headers end-to-end encryption

Is my email encrypted? How to check in Gmail and Outlook

Adrian Maverick · · 9 min read

Your email is almost certainly encrypted on its way between servers. Whether it is encrypted so that nobody else can read it is a different question, and the padlock in your inbox does not answer it. Here is how to check both, in about a minute per message.

Is my email encrypted? The short answer

Probably in transit, not end to end. Gmail, Outlook, iCloud, and Yahoo all use TLS to encrypt mail between servers when the other side supports it. But in standard accounts the provider stores your mail under its own keys and can read it. Only end-to-end or zero-access encryption keeps your provider out.

"Encrypted" hides three separate questions, and each has its own check:

  1. Was it encrypted in transit? Nobody on the network between mail servers could read it. This is TLS, and it is what the padlock shows.
  2. Can my provider read it? Once it is stored in your mailbox, does the company running it hold the key?
  3. Is it end-to-end encrypted? Only the sender's and recipient's devices ever see the readable text.

How to check if an email is encrypted in Gmail

Gmail shows a lock icon on every message you send and receive.

For a message you received: open it, click Show details (the small arrow under the sender's name), and look at the line labeled security. You will see one of these:

  • Standard encryption (TLS): encrypted in transit. Google calls this "the standard for most emails," which "prevents interception of your message in transit."
  • Enhanced encryption (S/MIME): available on work and school accounts. Google says these keys "are hosted by Google."
  • No encryption: the sender's server did not use TLS. Google's advice: "Do not send sensitive information, like passwords or financial details in unencrypted messages."

For a message you are sending: watch the recipient field while you compose. Gmail shows a red open lock next to a recipient whose provider will not accept an encrypted connection. No red lock means the message will travel with TLS.

On Google Workspace accounts you may also see a green lock (hosted S/MIME) or a blue shield (client-side encryption). The difference matters. With hosted S/MIME, Google "securely manages a copy of your key." With client-side encryption, "not even Google can open your briefcase." Only the blue shield keeps Google out.

How to check if an email is encrypted in Outlook

Outlook does not put a per-message TLS badge on ordinary mail, so you check in two places.

Encrypted messages: a message sent with Microsoft 365 Message Encryption or S/MIME shows a lock icon, and Microsoft adds "a banner at the top of the message that informs you of restrictions" such as Do Not Forward. If a message arrives as a link asking you to sign in or enter a one-time passcode, it was sent encrypted through Microsoft's portal.

Ordinary messages (TLS): read the headers.

  • Outlook.com and new Outlook: open the message, select the three-dot menu, then View, then View message details.
  • Classic Outlook for Windows: open the message, then File, then Properties, and read the Internet headers box.

Then look for the TLS lines described in the next section.

How to check if an email is encrypted in Apple Mail

Apple Mail has no per-message TLS indicator. For S/MIME, an encrypted message shows a lock icon in the header. For everything else, view the raw headers: on a Mac, choose View, then Message, then All Headers (or Raw Source). On iPhone there is no header viewer, so check the same message from a computer.

How to read email headers for TLS (the one-minute test)

Headers list every server a message passed through, newest first, in lines that start with "Received:". Search the header text (Ctrl+F or Command+F) for these markers:

What you see in a Received line What it means
with ESMTPS or with SMTPS That hop used an encrypted connection. The S stands for secured with TLS, as defined in RFC 3848.
version=TLS1_2 or version=TLS1_3, with a cipher= value The TLS version and cipher the servers agreed on. TLS 1.2 and 1.3 are current.
with ESMTP or with SMTP, no S and no TLS details That hop was probably sent in plain text.

A Gmail header for a TLS delivery typically contains something like with ESMTPS id ... followed by (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256).

Two caveats that header guides tend to skip. First, each server writes its own Received line, and not every server records whether it used TLS, so a missing marker on an early hop is not proof of plain text. Second, the line written by your own provider (the top one or two) is the one you can trust most. Earlier lines were written by servers you do not control.

Want to test it right now? Send yourself an email from a second account on a different provider, then open the headers on the receiving side. It takes less than a minute and shows you exactly what your provider logs.

Can my email provider read my email?

This is the question the padlock never answered. TLS protects the trip. The moment the message lands, the provider stores it, and in standard consumer email the provider holds the keys.

  • Gmail: "All Gmail messages use TLS automatically," per Google. Standard Gmail is not end-to-end encrypted. Only the client-side encryption described above locks Google out, and that is an enterprise feature.
  • iCloud Mail: Apple says iCloud Mail "does not use end-to-end encryption because of the need to interoperate with the global email system." That stays true even with Advanced Data Protection on, which covers most of iCloud but leaves out Mail, Contacts, and Calendar.
  • Outlook: Microsoft 365 Message Encryption protects a message from outsiders, but Microsoft runs the service and manages the keys.

Here is how the three questions shake out for common providers, with default settings:

Provider Encrypted in transit? Can the provider read stored mail? End-to-end by default?
Gmail (personal) Yes, when the other server supports TLS Yes No
Outlook.com Yes, when the other server supports TLS Yes No
iCloud Mail Yes, when the other server supports TLS Yes No

How to make the answer "yes" for stored mail

You cannot change question two with a setting in Gmail or iCloud. You change it by choosing a provider that never holds your keys.

That is the design of Secria Mail. Your keys are created on your device and only ever reach our servers encrypted, so your stored mailbox is sealed with keys we never hold. Mail from Gmail, Outlook, or anywhere else arrives over TLS like any email and is encrypted to your key the moment it reaches us. End-to-end encryption is automatic. The encryption is hybrid post-quantum (ML-KEM-1024 with X25519) on every plan, including free, so mail captured today cannot simply be stored and decrypted once quantum computers mature. If that sounds abstract, here is post-quantum encryption explained in plain words.

If what you actually need is to send one sensitive message today, from the account you already have, follow our step-by-step guide on how to send an encrypted email in Outlook, Gmail, or Apple Mail.

FAQ

Is Gmail encrypted?

In transit, yes: Gmail uses TLS whenever the other server supports it. At rest, your mail is encrypted on Google's servers, but Google holds the keys, so standard Gmail is not end-to-end encrypted. Only client-side encryption on eligible Workspace plans keeps Google out.

Does a padlock mean my email is private?

No. A padlock means the message was encrypted on the connection between mail servers. It says nothing about whether your provider, the recipient's provider, or anyone with legal access to either can read the stored copy.

Is my work email encrypted?

Almost certainly in transit, and your organization may add S/MIME or Microsoft 365 Message Encryption on top. Your employer's IT team and the provider it uses can still access the mailbox unless client-side encryption is in place. Ask IT which one you have.

Is iCloud Mail end-to-end encrypted?

No. Apple says so directly, and Advanced Data Protection does not change it. iCloud Mail is encrypted in transit and at rest under Apple's keys, not yours.

How do I know if an email I sent was encrypted?

In Gmail, check that no red lock appeared next to the recipient before you sent. In Outlook, an encrypted message shows its lock and banner in your Sent folder. For TLS on ordinary mail, ask the recipient to check the headers on their side, since the receiving server writes the line that matters.

The padlock certifies the journey, not the destination. Check it, then check who holds the keys where your mail is stored.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts