Search code examples
google-apigmail-api

Using encryption with Gmail API


Does the Gmail API use encryption when sending emails?

Is there a better SO board to post this question on? I will move it if so.


Solution

  • (1) All requests between your client and the Gmail API are over HTTPS, which is encrypted.

    (2) For calls like message.send() that generate an email to leave Google and go to another recipient, Google will do the same logic of attempting to send using encryption as when the user sends an email through web or mobile client. However unless your user is a GSuite user that has the "only send encrypted" policy enabled, the email sending may fallback to unencrypted if the remote side does not support encryption. For normal Gmail users if the remote side doesn't support encryption it may be delivered over plain text.

    (3) If you want end-to-end encryption something like S/MIME or PGP is best.

    (4) There's a new "STS" email standard that came out that Google supports that is a way for email providers to publish whether they require encryption to receive the email, which Gmail supports. When other providers also start publishing their STS records Gmail will respect it (and require encrypted transit to deliver those messages) Gmail STS