Email Encryption — TLS, S/MIME, PGP, MTA-STS, and DANE

Email encryption is really two separate problems wearing one label. Chapter 13 keeps them apart on purpose.

Transport encryption protects the connection between servers. STARTTLS upgrades a plaintext SMTP connection to TLS, but opportunistically — if negotiation fails, most implementations quietly fall back to plaintext. MTA-STS closes that gap by publishing a policy that mandates TLS. DANE solves a related problem via DNSSEC instead of the certificate-authority model.

End-to-end encryption protects the message content itself. S/MIME and PGP both solve this, and the chapter is clear that TLS alone never covers it — your mail provider can still read a message that traveled entirely over encrypted connections.

TLS-RPT ties it together as the reporting layer that tells you when TLS negotiation is actually failing.