S/MIME in Enterprise Email

Secure/Multipurpose Internet Mail Extensions is a standard for public key encryption and signing of MIME data, which is the format used for email. Unlike PGP, S/MIME uses X.509 certificates issued by Certificate Authorities rather than a Web of Trust. It is built into most enterprise email clients, making deployment easier in managed environments.

PGP relies on manually exchanging and trusting public keys. S/MIME relies on certificates that bind a public key to an email address and are signed by a trusted CA. The CA vouches for the identity of the certificate holder. If you trust the CA, you automatically trust certificates it issued, removing the need for individual key verification.

Personal S/MIME certificates can be obtained from commercial CAs such as Sectigo or DigiCert, sometimes free for personal use. The CA verifies that you control the email address before issuing the certificate. The resulting file contains your certificate (public key) and your private key. The certificate is then imported into your email client.

Microsoft Outlook has native S/MIME support on Windows and can be configured to automatically sign or encrypt all outgoing mail once a certificate is installed. Apple Mail on macOS and iOS also supports S/MIME natively, displaying padlock icons for encrypted messages and ribbon icons for signed messages. No plugins are required in either client.

S/MIME supports two independent operations. A digital signature attaches a cryptographic proof that the message came from the stated sender and has not been modified. Encryption scrambles the message body so only the recipient can read it. You can sign without encrypting, encrypt without signing, or do both. Most enterprise deployments require at minimum signing.

When you sign an email with S/MIME, your email client uses your private key to create a signature over the message hash. The recipient's client verifies the signature using your certificate's public key and confirms the certificate was issued by a trusted CA. A valid signature tells the recipient that the message genuinely came from your email address and has not been tampered with.

To send an encrypted S/MIME email, you need the recipient's certificate, specifically their public key. Recipients typically share their certificate by first sending you a signed email, after which your email client automatically stores their certificate. Without the recipient's certificate on file, encryption is not possible, which is a common deployment friction point.

Large organisations often run their own internal Certificate Authority using Microsoft Active Directory Certificate Services or similar. The internal CA issues S/MIME certificates to all employees automatically through Group Policy. All company computers trust the internal CA by default, enabling seamless encrypted and signed email within the organisation without external CA costs.

S/MIME uses a hierarchical CA trust model while PGP uses a decentralised Web of Trust. S/MIME certificates carry identity metadata verified by the CA; PGP keys carry whatever the owner claims. S/MIME is better suited to managed corporate environments; PGP is more flexible for independent users. Both provide equivalent cryptographic strength when properly configured.

S/MIME integrates directly into Outlook, Exchange, and Active Directory without additional software. IT departments can automate certificate issuance and renewal. Compliance frameworks like HIPAA and financial regulations often specifically reference S/MIME. PGP requires installing plugins, managing a keyring, and training users on the Web of Trust, making it harder to deploy at scale.

S/MIME encrypts the message body but not the subject line, which remains in plaintext. Encrypted messages cannot be searched or filtered by the mail server. If you lose your private key, encrypted archived emails become permanently unreadable. Key escrow by the organisation CA is common to prevent data loss but creates a third party with access to all encrypted mail.

What is required before you can send an S/MIME encrypted email to a colleague?

S/MIME provides email encryption and digital signatures using X.509 certificates from trusted CAs. It is built into Outlook and Apple Mail, making enterprise deployment straightforward. Signing proves sender identity; encryption requires the recipient's certificate. Internal CAs enable automatic certificate provisioning at scale. Subject lines remain unencrypted in all S/MIME implementations.