Email Privacy & Encryption Resources
Primary sources behind the guides on this site: the encryption standards, provider documentation, and security-planning material the setup guides here are downstream of. Links go to the original, not to a summary.
Start Here
- Your Security Plan — EFF Surveillance Self-Defense
The threat-modelling walkthrough that decides whether encrypted email is worth it for you. Five questions, worked through properly.
Electronic Frontier Foundation #guide - Communicating With Others — EFF SSD
Why end-to-end encryption protects content but not the metadata of who mailed whom, and when.
Electronic Frontier Foundation #guide - Privacy Guides — Email Services
Maintained, criteria-based recommendations for private email providers, with the reasoning published alongside them.
Privacy Guides community #guide
Encryption Standards
- RFC 9787 — Guidance on End-to-End Email Security
The current IETF guidance on what PGP/MIME and S/MIME can and cannot guarantee for email.
IETF #spec - RFC 9580 — OpenPGP
The 2024 refresh of the OpenPGP message format that PGP email is built on.
IETF #spec - RFC 8551 — S/MIME 4.0 Message Specification
The certificate-based encryption standard used by Outlook and most corporate mail.
IETF #spec - RFC 7208 — Sender Policy Framework (SPF)
How receivers check which hosts are allowed to send mail for a domain.
IETF #spec - RFC 6376 — DomainKeys Identified Mail (DKIM)
The cryptographic signature that lets a receiver verify a message was not altered in transit.
IETF #spec - RFC 7489 — DMARC
How SPF and DKIM combine into a published policy that stops others forging your domain.
IETF #spec
Provider Documentation
- How Proton Mail Messages Are Encrypted
Proton's own account of what is end-to-end encrypted, what is only encrypted at rest, and what stays visible.
Proton #docs - Proton End-to-End Encryption
The security model behind mail exchanged between Proton addresses.
Proton #docs - Proton Transparency Report
What Swiss legal process can and cannot compel Proton to hand over. Read this before relying on jurisdiction.
Proton #docs - Proton Mail Bridge
The local application that lets Thunderbird, Apple Mail, or Outlook use a Proton account over IMAP and SMTP.
Proton #docs - Tuta Encryption
Tuta's design, including subject-line encryption, which is the main line where it differs from Proton.
Tuta #docs
PGP & Encryption Tools
- GnuPG (GPG)
The reference free implementation of OpenPGP for generating and managing keys.
The GnuPG Project #tool - OpenPGP in Thunderbird — HOWTO and FAQ
Thunderbird's built-in OpenPGP, which replaced the obsolete Enigmail add-on.
Mozilla #tool - Mailvelope
A browser extension that adds OpenPGP to webmail such as Gmail without a desktop client.
Mailvelope #tool - SimpleLogin
Email alias service for handing out a different address per signup.
SimpleLogin (Proton) #tool - addy.io (formerly AnonAddy)
Open-source alias forwarding, including catch-all custom domains.
addy.io #tool
Email Authentication & Deliverability
- DMARC.org
The overview and deployment guidance maintained by the group behind the DMARC specification.
DMARC.org #reference - Proton: Anti-spoofing for Custom Domains (SPF, DKIM, DMARC)
The exact records a custom domain needs, with the Proton-specific include and selectors.
Proton #docs - Check Your Email Security (Gmail)
How to read Gmail's lock indicator to tell TLS, S/MIME, and unencrypted mail apart.
Google #docs
Account Security & Advocacy
- NIST SP 800-63B — Digital Identity Guidelines
The authentication and recovery guidance behind the 2FA and password advice in these guides.
NIST #reference - Deep Dive: End-to-End Encryption — EFF SSD
How public-key encryption works, and what intermediaries can still see.
Electronic Frontier Foundation #guide - Have I Been Pwned
Check whether an address has appeared in a known breach before you make it your primary inbox.
Troy Hunt #tool - Electronic Frontier Foundation
The advocacy organisation behind Surveillance Self-Defense and much of the public record on email privacy.
EFF #org