In Apple Mail, how do you implement TLS security?

carefulowner wrote:

Matt,

Does it matter that I use only POP e-mail (not IMAP)? All my devices are desktops;

Just to confirm mberardinelli's reply, I employ POP for Mail and remembered seeing the TLS option the last time it was set up, went back and checked, below are a couple of screen shots - it's certainly available under macOS Mail but as said previously does require support by your mail provider (mine apparently doesn't so still using SSL).

Best of luck.

Hi there,

Mail in Sierra does in fact support TLS. As long as your email provider uses TLS for their SMTP servers, you will be able to enable it within the Mail app. This can be done by opening Mail > Preferences > choose your email account > Advanced IMAP settings button (in there, you can choose a TLS certificate to use). Information about how to set this up depends on your email provider, so they should have instructions available for you on exactly what to put in there.

The thing to be aware of is that TLS only works if it is being used on the email provider's SMTP server(s). Most do these days, since TLS is essentially a successor to SSL.

In short, the way TLS works is it will establish a connection between the client and the SMTP server by way of a certificate, which authenticates you to the SMTP server. From there, the transmission of your email to and from the SMTP server will be encrypted. This does not, however, affect the security/encryption of the email before it is sent nor after it is received. And whether or not the email will be encrypted from your provider's SMTP server to the recipient's inbound server depends on whether or not the recipient's server is set to use TLS for inbound mail.

There is a really nice article on how TLS works here, and the links at the bottom have a lot of useful info too: https://luxsci.com/blog/smtp-tls-all-about-secure-email-delivery-over-tls.html

I hope this helps!

Cheers,

Matt

Well, TLS will encrypt the email for its entire transit, provided that both your email provider AND the recipient's email provider support it. So we know for a fact that the email being sent by you will be encrypted on its way to your email provider's SMTP server. Whether or not it is encrypted from your SMTP to your recipient depends on the recipient's email provider. These days though, it is pretty common.

Vice versa, when you are receiving an email - it will be encrypted from your SMTP server to your inbox via TLS. But again, whether it was encrypted from the original sender to your SMTP server is dependent on their email provider.

And yes, you should be able to enable TLS in Mail regardless of whether you're using IMAP or POP/SMTP. I just gave IMAP as an example because that happened to be what I was looking at on my own computer 🙂

You can actually check to see which transit legs of an email were (or were not) encrypted by examining the headers on an email. In Mail, choose a message you want to examine, and then go View > Message > All Headers. This will display a bunch of technical info on the top of your email. In there, you can see each server that touched the message in the lines beginning with "Received" (they are in reverse chronological order - so the first server to touch it will be at the bottom of the list). Here you can see whether or not each step used TLS. There is another good article with visual examples of this here: https://luxsci.com/blog/how-you-can-tell-if-an-email-was-sent-using-tls-encrypti on.html

Cheers,

Matt