Email in itself is neither secure nor dangerous: its security depends on how your account, email client and domain are configured, and how you use them. Below, we outline what modern email protects, what it does not, and what you can do.

What does an encrypted connection protect?

Traffic between the email client and the server is encrypted using TLS, provided the account has been set up correctly: port 993 for IMAP, port 995 for POP3, and port 465 (SSL/TLS) or 587 (STARTTLS) for outgoing SMTP. This means that your password and emails cannot be intercepted, even on a public Wi-Fi network. Servers also usually transmit emails to one another in an encrypted form; Gmail, for example, requires TLS from the servers sending emails to it.

What TLS does not protect: the message is stored in a readable format on the sender’s and recipient’s servers, and the recipient can forward it. If content is to be readable only by the recipient, end-to-end encryption is required (S/MIME or OpenPGP), or a file encrypted with a password, the password for which is communicated via a separate channel, such as by telephone.

Account security

1. Strong, unique passwords: use a different password for each account, with at least 12–16 characters, and store them in a password manager. Attackers will first try passwords that have been leaked from other sites.
2. Two-factor authentication: where available (client portal, control panel, free email accounts), please enable it.
3. Be careful with links: most accounts are not hacked, but passwords are tricked out of users via a fake login page. Our article on phishing emails will help you recognise them.
4. Updated software: updates to the operating system, browser and email client fix numerous bugs that could be exploited via attachments.

Domain protection

Anyone can attempt to send an email on behalf of a domain. SPF, DKIM and DMARC records work together to enable receiving servers to recognise and filter out spoofed emails. It is advisable to set up all three for your own domain.

The role of the service provider

The provider offers server-side protection through spam and virus filtering, the blocking of unauthorised forwarding (open relay) and backups. In our email hosting plans, the spam filter can be customised, and daily backups are taken of emails, meaning that even an accidental deletion is not permanent.

What should you not send by email?

Do not send passwords, credit card numbers, copies of identity documents or medical data without encryption. If you do need to send such information, use an encrypted file or an access-protected file-sharing service.

What should you do if someone has gained access to your account?

Signs may include: emails you did not send appearing in your Sent folder, emails bouncing back from unknown addresses, or your partners receiving strange emails from you.

1. Change your account password from a clean, up-to-date device.
2. Check your forwarding rules, filters and automatic replies, as attackers often leave behind a hidden forwarding rule.
3. Set your new password on all your devices; do not use the old one anywhere else.
4. Run a virus scan on your computer.
5. Please notify our support team and your partners if any unsolicited emails have been sent from your account.

The full checklist is included in the article on hacked email accounts, with sections on cPanel and web hosting.