Understanding email encryption

Fastmail published an explainer on email encryption, breaking down how TLS, PKI, and Certificate Transparency protect email connections and where each method's protections end. The piece outlines a threat model spanning account compromise, malware, spam misclassification, and data loss as common risks, with network eavesdropping, breaches, and physical theft as less frequent but serious concerns. It explains that TLS 1.3 encrypts traffic between devices and provider servers, while certificates signed by authorities like Let's Encrypt verify server identity, and CT logs let domain owners detect fraudulent certificate issuance. For high-risk users such as journalists and activists, the article notes the threat model extends to provider insider threats and government legal compulsion. The article was cut off mid-discussion of CT log monitoring, leaving deeper coverage of end-to-end encryption and provider-side protections unaddressed.