How can I send secure email using Outlook?

Sending confidential information through ordinary email is risky — a message in transit can be read by anyone who intercepts it, and a message sent to the wrong address is simply gone. Outlook has three built-in ways to protect a message, none of which require third-party software. This guide covers what each does, when to use it, and what to check when encryption misbehaves.

Why should I encrypt emails sent from Outlook?

Unencrypted messages can be read by anyone who intercepts them in transit. Encryption scrambles the content so only the intended recipient can open it, and it limits the damage when a message goes to the wrong address. For regulated industries such as finance and healthcare, encryption is often the control that makes email an acceptable channel at all.

Encryption protects the contents of a message. It does nothing to stop an attacker sending mail that appears to come from your domain — a separate problem, solved with DNS records rather than with Outlook.

What built-in encryption options does Outlook offer?

Outlook offers Microsoft Purview Message Encryption, which is the current name for what Microsoft used to call Office 365 Message Encryption (OME). Microsoft deprecated the OME branding on 1 July 2023 and replaced it automatically; you may still see the old name in older documentation and in parts of the admin UI.

Purview Message Encryption gives you two options when composing:

• Encrypt-Only — the message is encrypted, but the recipient can still reply and forward.
• Do Not Forward — the recipient cannot forward, print, or copy the message.

It works with most email providers and requires no extra software on the recipient's side.

Encryption is included with Office 365 E3/E5, Microsoft 365 E3/E5, Microsoft 365 Business Premium, Office 365 A1/A3/A5, and Office 365 Government G3/G5. Other plans — including Microsoft 365 Business Basic and Business Standard — need the Azure Information Protection P1 add-on. Beware older runbooks citing "Office 365 Business Premium": that plan was renamed Microsoft 365 Business Standard in April 2020, and Business Standard does not include encryption on its own.

How do I encrypt a single message in Outlook?

Compose your email as usual, then open the Options tab on the ribbon and choose Encrypt. Pick Encrypt-Only or Do Not Forward — your administrator may have published additional templates. Outlook shows a lock icon to confirm the message is protected. The same Options → Encrypt path works in classic Outlook for Windows, new Outlook, and Outlook on the web.

After you send, the recipient either sees the message inline — if they are on Microsoft 365 — or receives a wrapper email linking to the encrypted-message portal.

What does the "Do Not Forward" option do?

Do Not Forward applies rights-management restrictions on top of encryption: the recipient cannot forward, print, or copy the message. It suits contracts, legal briefs, and payroll information. The restriction is enforced by the mail client, so recipients on clients that do not support it are routed to the secure web portal, where the same restrictions apply.

Treat Do Not Forward as a guardrail against casual resharing, not a guarantee — a determined recipient can still photograph the screen.

How can sensitivity labels automate email protection?

Sensitivity labels are classification tags that carry protection rules with them. Rather than remembering to encrypt each message, you tag it Confidential or Highly Confidential and Outlook applies the encryption, watermarking, and forwarding rules attached to that label. Labels can also enforce expiration dates.

Labels are created and published centrally by an administrator in the Microsoft Purview portal, under Information Protection. The technology is now called Microsoft Purview Information Protection; it was previously branded Microsoft Information Protection (MIP), so older guides that tell you to "enable MIP" are describing the same thing.

To apply one, click Sensitivity in the compose window and choose a label. If the button is missing, your administrator has not published any labels to your account.

What is S/MIME and when should I use it?

S/MIME (Secure/Multipurpose Internet Mail Extensions) provides end-to-end encryption and digital signatures using X.509 certificates. It is the strongest option Outlook offers, but it requires both sender and recipient to hold valid certificates — which is why it tends to appear in regulated, closed communities such as legal filings, healthcare records, and government contracts rather than in general business mail.

Use Purview Message Encryption when you need to send protected mail to anyone. Use S/MIME when you need cryptographic proof of authorship and non-repudiation, and you control both ends.

How do I set up S/MIME certificates in Outlook?

First, obtain a certificate from a trusted Certificate Authority or your organisation's internal PKI. Then, in classic Outlook for Windows, go to File → Options → Trust Center → Trust Center Settings → Email Security. Use Import/Export to install the certificate, then tick Encrypt contents and attachments for outgoing messages. Tick Add digital signature to outgoing messages if you want every message signed.

New Outlook for Windows and Outlook on the web do not use the Trust Center. New Outlook supports S/MIME signing and encryption, picking up certificates already provisioned to the machine or the user, so there is no equivalent manual import step.

How do domain-level records complement Outlook encryption?

Encryption protects a message you send. It does not stop an attacker from sending mail that claims to be from your domain — recipients have no way to tell the difference. That problem is solved with three DNS records: SPF names the servers allowed to send for your domain, DKIM signs outgoing mail, and DMARC tells receiving servers what to do when a message fails both.

Without these, spoofing your domain is trivial, and encrypting your internal mail does nothing to prevent it. Palisade's Email Security Score checks all three records and reports what is missing; you can also check each individually with the DMARC, SPF, and DKIM tools. Once DMARC reaches enforcement, BIMI can display your logo beside authenticated messages.

What best practices should I follow?

• Encrypt based on the sensitivity of the content, not the convenience of the recipient.
• Keep subject lines vague — the subject is not encrypted.
• Test encryption with a new recipient before sending critical data.
• Verify recipient addresses carefully; a mis-sent encrypted message is hard to claw back.
• Keep S/MIME certificates current and backed up. An expired certificate silently breaks signing.

Common issues with Outlook email encryption

Why can't I see the Encrypt button in Outlook?

The Encrypt option depends on both your licence and your administrator's configuration. Confirm your plan includes Purview Message Encryption — Microsoft 365 Business Standard does not, without the Azure Information Protection P1 add-on. If the licence is right and the button is still missing, either the administrator has not enabled the feature or your client has not picked up the policy yet. Restart Outlook, then contact your admin.

Why did my encrypted message arrive as a broken link or a bare attachment?

External recipients receive a wrapper message linking to the encrypted-message portal. If their mail gateway strips HTML or rewrites links, that wrapper can arrive looking broken. Ask the recipient to open the message in a browser rather than a mobile preview pane, and ask their administrator to allow-list Microsoft's encryption portal. Recipients can authenticate with a Microsoft, Google, or Yahoo account, or with a one-time passcode.

Why won't Outlook encrypt my large attachment?

Messages sent with Microsoft Purview Message Encryption are capped at 25 MB including attachments. Larger messages fail rather than send truncated. Share the file from OneDrive or SharePoint and send the protected link instead — the link inherits the file's permissions, which is usually the outcome you actually wanted.

Why doesn't message recall work the way I expect?

Recall only works within your own organisation: you cannot recall a message sent over the internet or across tenants, and hybrid customers cannot recall cloud-sent messages that landed in on-premises mailboxes. Note that Outlook's recall dialog still claims only unread messages can be recalled — Microsoft's own documentation states that this statement is no longer accurate, because cloud-based message recall can remove already-read messages when an administrator has enabled that setting. Recall of encrypted messages works only if the sender is assigned the Premium Encryption in Office 365 service plan and starts the recall from Outlook on the web or new Outlook.

Frequently asked questions

Does encrypting a message hide the subject line?

No. Purview Message Encryption protects the body and attachments, but the subject line travels in the clear so mail systems can route and thread the message. Never put an account number, a patient name, or a password in the subject of a message you are encrypting.

Will encryption slow down email delivery?

Processing adds only a few seconds. The perceptible delay is on the recipient's side, when an external recipient authenticates to the portal before reading. Server-to-server delivery speed is unchanged.

Does S/MIME work if only I have a certificate?

You can sign messages with only your own certificate, and recipients can verify the signature. You cannot encrypt to a recipient until you hold their public certificate, which normally means they have signed a message to you first. This chicken-and-egg step is why S/MIME rarely works for one-off external correspondence.

Does encryption protect me if my domain gets spoofed?

No, and this is the most common misunderstanding. Encryption protects messages you send. Spoofed mail is sent by someone else who never touches your mailbox. Only SPF, DKIM, and DMARC published in your DNS can stop that — run an Email Security Score check to see whether yours do.

Can I use a sensitivity label and S/MIME on the same message?

They are separate protection systems and are not designed to be stacked. Use a sensitivity label when you want centrally managed policy applied automatically; use S/MIME when you need certificate-based proof of authorship. If a label already applies encryption, adding S/MIME on top gains you nothing.

Related reading

• What are DMARC, DKIM, and SPF?
• The ultimate guide to preventing phishing attacks
• What is email impersonation and how can you prevent it?