Email Hardening Guide

Email Hardening Guide

Email Hardening Guide

This page provides a comprehensive guide to securing email communications, which is crucial for both personal and organizational cybersecurity. Proper email security can mitigate risks associated with a variety of cyber threats.

Introduction to Email Security

Email systems are common targets for cyber threats such as phishing, malware, and unauthorized access. Enhancing email security involves implementing strong security measures, using the right tools, and educating users on potential risks.

Common Email Threats

• Phishing and Spear Phishing: Deceptive emails that attempt to collect sensitive information. See Teaming Phishing and Smishing Guide.

• Malware: Malicious software distributed through email attachments or links.

• Spam: Unsolicited emails that can clog inboxes and potentially lead to phishing or malware.

Email Services

Email services are critical for communication but come with inherent risks. Selecting a secure email provider and using tools like aliasing services can significantly enhance privacy and security.

Recommended Email Providers

For a more expansive guide and the source to this section, see PrivacyGuides

• Disroot: More than just email and focused on privacy and security allowing smtp, imap, and gpg/pgp. It takes several days to have your account request approved but it is real.

• ProtonMail: Offers end-to-end encryption and advanced security features.

• Tutanota: Provides secure, encrypted email storage and messaging.

• Mailbox.org: Focused on privacy and ad-free service.

• StartMail: Easy-to-use encrypted email for businesses and individuals.

Recommended Email Clients

For a more expansive guide and the source to this section see PrivacyGuides

• Thunderbird (Desktop & MacOS)

• CanaryMail (MacOS & iOS)

• FairMail (Android)

Email Aliasing

For a more expansive guide and the source to this section see PrivacyGuides Email aliasing provides an additional layer of privacy by hiding your primary email address and generating unique addresses for different services.

Benefits of Email Aliasing

• Hides your “main” email address from marketers and trackers.

• Shields your inbox from spam and correlating accounts.

• Allows you to turn off or delete aliases when no longer needed.

Recommended Email Aliasing Services

• SimpleLogin: Offers free and premium aliasing services, with integration for ProtonMail.

• Addy.io: Free plan with 10 shared and unlimited “standard” aliases.

• AnonAddy: Open-source aliasing service with robust privacy features.

Using Aliases

• Generate a unique alias for each website or service.

• Enable replies to be sent from aliases for added privacy.

• Consider paid aliasing services and additional features for custom domains.

Best Practices for Email Security

Email Encryption

Email is not the right tool for interactive private conversation

Even with PGP, email is fundamentally a weaker E2EE channel than modern secure messengers like Signal, SimpleX, or Matrix/Element:

• No forward secrecy — long-lived PGP keys mean a single private-key compromise exposes all past encrypted messages retroactively. Modern messengers rotate ephemeral keys per message.
• Metadata in plaintext — sender, recipient, timestamps, subject lines (PGP doesn’t encrypt them), and mail-server hop logs are all visible to network observers and providers.
• HTML rendering attacks — EFAIL (2018) demonstrated malicious HTML email exfiltrating decrypted PGP plaintext. Messengers don’t have an HTML layer.
• Non-repudiation — PGP signatures are designed to be permanent proof of authorship. The opposite of what sources, whistleblowers, or anyone wanting plausible deniability should want.
• Bad UX → frequent errors — users encrypt to wrong keys, send unencrypted by mistake, click past warnings.

For real-time secure conversation, use a secure messenger instead — Signal as the safe default, SimpleX for maximum metadata resistance, Matrix/Element for our community’s federated chat.

Email + PGP is still the right tool for software release signing, Git commit signing, identity attestation, and async signed/encrypted messages across organizations that don’t share a messenger app. That’s what the rest of this section covers.

Two different things often get conflated under “email encryption”:

• Transport encryption (TLS) — encrypts the SMTP/IMAP/POP3 connection between mail servers and between you and your provider. Default at major providers since the mid-2010s. Doesn’t protect message contents from the providers themselves. Modern hardening: MTA-STS (forces TLS between servers) and DANE (DNSSEC-anchored TLS validation).
• End-to-end encryption (E2EE) — your client encrypts the message; only the recipient’s client can decrypt it. Your provider, network adversaries, and any party in between see ciphertext only. This is what people usually mean by “encrypted email.”

For E2EE, the open standard is OpenPGP (also called PGP). ProtonMail and Tutanota offer E2EE between users of their own service — ProtonMail uses OpenPGP under the hood (so it interoperates with external PGP users), Tutanota uses a proprietary scheme (it does not).

Where the deep setup lives

This section covers the email-specific PGP picture. For generating keys, the offline-master + on-card-subkeys workflow, and using the same key for Git commits + SSH, see the dedicated SSH & GPG Keys page and especially Hardware-Backed Keys. Same crypto, different application.

PGP-Capable Email Clients

Client	Platform	Hardware-key OpenPGP	Notes
Thunderbird (115+)	Desktop	✅ via external gnupg	Native OpenPGP since v78 — Enigmail is no longer needed. Set mail.openpgp.allow_external_gnupg=true for smartcard / YubiKey support; the bundled keyring handles software-only keys.
Mutt / NeoMutt	Terminal	✅	Delegates everything to gpg-agent. Cleanest hardware-key workflow once configured.
Apple Mail + GPG Suite	macOS	✅	GPG Suite installs gpg-agent and integrates with Mail. Occasional breakage on macOS major upgrades — many users have drifted to plain Homebrew gnupg.
Thunderbird for Android + OpenKeychain	Android	✅ over USB-C and NFC	F-Droid: net.thunderbird.android + org.sufficientlysecure.keychain. The K-9 → Thunderbird rebrand completed late 2024; don’t run both.
Mailvelope	Browser webmail (Gmail, Yahoo, etc.)	⚠️ via local gnupg bridge only	Adds PGP to webmail without a desktop client. Browsers can’t drive a smartcard directly over WebUSB/WebHID — Mailvelope shells out to local gnupg, which has to be set up separately.
ProtonMail (web + native)	All	❌	Proprietary in-browser PGP keystore. Cannot use an external smartcard. Long-standing feature request.
Tutanota	All	❌	Different E2EE scheme; not OpenPGP.
Outlook	All	❌ for OpenPGP	S/MIME only — usable with a YubiKey’s PIV slot via Windows CSP, but that’s S/MIME, not OpenPGP.

Mobile reality check

The right answer depends on whether you want software-stored keys on the phone or a hardware smartcard (YubiKey, Nitrokey).

• Software-key OpenPGP on Android — Thunderbird-for-Android + OpenKeychain works with keys stored in OpenKeychain’s encrypted vault. Standard .asc import/export.
• Software-key OpenPGP on iOS — iPGMail (~$4, actively maintained — v2025.39.1 Nov 2025) is the recommended option. Imports/exports .asc, keys stored in the iOS Keychain (Face/Touch ID gated), share-sheet workflow because iOS forbids Mail.app plugins. Canary Mail is the alternative if you want OpenPGP baked into the mail client itself (subscription).
• Hardware-smartcard OpenPGP on Android — works: Thunderbird-for-Android + OpenKeychain drives a YubiKey or Nitrokey over USB-C or NFC. Setup is fiddly the first time; reliable once configured.
• Hardware-smartcard OpenPGP on iOS — dead path as of 2026. No iOS app drives the OpenPGP applet on a YubiKey 5Ci (Lightning) or USB-C iPhone. If you specifically need smartcard-backed PGP from a phone, that phone is Android.

PGPro is abandoned

PGPro (free, open-source iOS PGP app) was the previous default recommendation, but its last update was November 2021 and the developer removed it from the App Store in January 2025. Many older privacy guides still link to it — don’t follow them. Use iPGMail ($3.99 one-time, App Store) or Canary Mail (Pro+ subscription) instead.

For the broader mobile picture — including all the F-Droid + Play Store Android options, the OpenKeychain maintenance-mode caveat, and Termux/GnuPG power-user setups — see the Mobile Hardening Guide → OpenPGP / GPG Apps section.

PGP Key Management Basics

• Use subkeys. One offline master key that only certifies; separate Sign, Encrypt, and Authenticate subkeys for daily use. Master stays on encrypted offline storage; only subkeys go on your daily-driver machine or hardware key. Compromise of one subkey doesn’t burn your whole identity.
• Set an expiry. 1–2 years is reasonable. You can extend it before it expires. Forces you to think about rotation.
• Export a revocation certificate immediately after generating the master, and store it offline. This is the only way to tell the world to stop trusting your key if you ever lose access to the master.
• Publish your public key to keys.openpgp.org (the modern verified-email keyserver — no SKS-style key-flooding) or share the .asc file directly.
• Refresh periodically with gpg --refresh-keys to pick up revocations and key updates from correspondents.

The step-by-step walkthrough for all of this lives in SSH & GPG Keys → GPG (OpenPGP) Keys. Same key material applies to both email and Git commit signing — generate once, use everywhere.

Best Practices for Email Security

Use Strong, Lengthy Passwords

• Create passwords with a minimum of 16 characters that include a mix of letters, numbers, and symbols. Refer to the Manager Guide.

• Avoid using easily guessable passwords such as sequential letters or numbers.

Enable Multi-Factor Authentication (MFA)

• Enable MFA on all email accounts. Email is the recovery anchor for most other accounts, so it deserves the strongest factor you have — ideally a passkey or a hardware security key (YubiKey, Nitrokey). A TOTP authenticator app (Aegis on Android, Ente Auth cross-platform) is the fallback. Avoid SMS — SIM-swap attacks specifically target email-reset flows. See the MFA Guide for the full hierarchy.

Regularly Update Security Settings

• Ensure your email software and applications are up-to-date to protect against known vulnerabilities.

• Regularly review your email account settings to ensure they align with the latest security practices.

Be Cautious with Email Attachments and Links

• Always verify the sender’s email address and be wary of unexpected attachments or links.

• Use email scanning tools to detect malicious attachments and links before opening them.

Use Secure Connections

• Ensure HTTPS is enabled when accessing email online.

• Use a reliable VPN service when accessing email on public or unsecured Wi-Fi networks.

Password Management

• Strongly consider using a password manager to generate and store complex passwords. This is essential for maintaining strong security across multiple accounts. See the Manager Guide.

Countermeasures for Email Threats

Organizational Level

• Phishing Awareness Training: Regularly train staff to recognize and properly handle phishing attempts.

• Anti-Malware and Anti-Spam Solutions: Use comprehensive security solutions that include email scanning, such as Norton, McAfee, or Kaspersky.

Personal Level

• Security Apps: Utilize apps that help identify and block phishing and spam on personal devices.

• Educational Resources: Continuously educate yourself about email security through resources and updates. Example: Stay Safe Online’s Email Security Tips.

Additional Resources

• Google Phishing Virtual Environment Training

• Guide to Using ProtonMail for Secure Email

• FTC Consumer Advice on Email Security

Related

• SSH & GPG Keys — full GPG/OpenPGP key generation, subkey strategy, and hardware-key (YubiKey/Nitrokey) setup; same key works for email and Git commits
• MFA Guide — passkeys, hardware security keys, and TOTP for protecting your email account itself
• ProtonMail Bridge on Linux — connect a desktop client to ProtonMail’s encrypted mailbox