--- title: "Protect sensitive data in email: SSL & TLS Best Practices" description: SSL (Secure Sockets Layer) and TLS (Transport Layer Security) practices for securing (encrypting) the connection between a mail client and mail server. image: https://blog.mdaemon.com/hubfs/Email_Encryption_SSL_TLS_Guide.jpg --- [![MDaemon Technologies](https://blog.mdaemon.com/hs-fs/hubfs/MDaemon-Technologies_logo_large.png?width=564&height=110&name=MDaemon-Technologies_logo_large.png "MDaemon Technologies")](https://mdaemon.com/) - [Blog Home](https://blog.mdaemon.com) # MDaemon Technologies Blog ## [Protect sensitive data in email: SSL & TLS Best Practices](https://blog.mdaemon.com/ssl-tls-best-practices) By [Brad Wyro](https://blog.mdaemon.com/author/brad-wyro) - [Tweet](https://twitter.com/share) You may have heard the terms SSL and TLS, but do you know what they are and how they’re different? SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are methods of securing (encrypting) the connection between a mail client and mail server (Outlook and MDaemon, for example) or between mail servers (MDaemon and another mail server, for example). They’re also the technology that secures the connection between a website and your browser. In this post, we’ll focus on their use for encrypting email connections. Without SSL or TLS, data sent between mail clients and servers would travel in plain text. That potentially opens up your business to theft of confidential information, stolen credentials, and accounts being hijacked to send spam. SSL and TLS help protect that data, allowing users to securely transmit sensitive information such as Social Security numbers, credit card numbers, or medical records over email. A quick note on terminology before we go further: although nearly everyone still says “SSL,” the SSL protocol itself is obsolete. Every secure connection made today actually uses TLS. The “SSL” name has simply stuck around in everyday language (and in phrases like “SSL certificate”), so when you see SSL and TLS used together, think of TLS as the modern protocol doing the real work.   ### **How do SSL and TLS work?** To use TLS, you’ll need an [SSL/TLS certificate](https://en.wikipedia.org/wiki/Public_key_certificate) installed on the server. The certificate contains a public key and is paired with a private key kept secret on the server. Together they let a client confirm it’s talking to the genuine server and establish an encrypted connection. When a mail client or server connects to another server using TLS, the secure connection is set up through a process called the “TLS handshake.” During the handshake the two sides agree on which protocol version and cipher to use, the client verifies the server’s certificate, and both sides cooperatively generate a shared **session key**. The public/private key pair is only used during the handshake to authenticate the server and safely establish that session key. Once the secure connection is in place, all transmitted data is encrypted with the symmetric session key. This diagram provides a simplified overview of how a TLS connection is established: ![SSL_TLS-handshake](https://blog.mdaemon.com/hs-fs/hubfs/SSL_TLS-handshake.png?width=712&height=441&name=SSL_TLS-handshake.png) Both SSL and TLS protect data privacy through data-in-motion encryption, provide server-side and (optionally) client-side authentication of the communication channel, and help ensure message integrity. ***Note****: In addition to encryption of the connection via TLS, MDaemon can be configured to encrypt the actual email message (not just the connection) using OpenPGP. More info can be found here: [https://knowledge.mdaemon.com/enable-and-configure-mdaemon-pgp.](https://knowledge.mdaemon.com/enable-and-configure-mdaemon-pgp)*   ## Email ports and encryption POP, IMAP, and SMTP traffic is transmitted over designated ports, and there’s a dedicated encrypted port for each protocol: - **IMAP** uses port **143** for unencrypted connections and port **993** for IMAP over TLS. - **POP3** uses port **110** for unencrypted connections and port **995** for POP3 over TLS. - **SMTP** uses port **25** for server-to-server mail delivery. For mail submission from a client, port **587** is the standard submission port (typically secured with STARTTLS), and port **465** is used for submission with TLS active from the moment the connection opens. For encryption to take place over these connections, the mail client and mail server must both be configured to use the proper ports, and a valid certificate must be installed on the server.  Note: Here's how to enable and configure SSL & TLS in MDaemon: [https://knowledge.mdaemon.com/how-to-enable-configure-ssl-tls-for-smtp-pop3-imap-in-mdaemon](https://knowledge.mdaemon.com/how-to-enable-configure-ssl-tls-for-smtp-pop3-imap-in-mdaemon) You’ll notice there are two ways to add encryption here, which brings us to an important distinction.    ## STARTTLS vs. Implicit TLS There are two ways a mail connection can become encrypted: **STARTTLS (explicit TLS).** The client first connects on a normal “plaintext” port (such as 587 for submission, 143 for IMAP, or 110 for POP3), then issues a STARTTLS command (STLS for POP3) to upgrade that connection to an encrypted one before any sensitive data is sent. **Implicit TLS.** The client connects to a dedicated port (465 for submission, 993 for IMAP, 995 for POP3) and the TLS handshake happens immediately, before any other commands are exchanged. The connection is encrypted from the very first byte. The catch with STARTTLS is that it’s *opportunistic* by default: the brief plaintext moment before the upgrade gives a network attacker a window to strip out the STARTTLS offer and trick the two sides into never encrypting at all (a “downgrade” or “STRIPTLS” attack). Because of this, RFC 8314 now recommends preferring implicit TLS where possible, and recommends configuring clients to *require* TLS so they refuse to send mail in the clear if encryption can’t be negotiated. (This is also why port 465, once deprecated, was officially brought back for submission with implicit TLS.) MDaemon supports both approaches. It implements STARTTLS over TLS for SMTP and IMAP and STLS for POP3, as well as implicit TLS on the dedicated ports. You can also use MDaemon’s **[STARTTLS List](https://help.mdaemon.com/MDaemon/en/ssl_starttls-required-list.html)** and **[No STARTTLS List](https://help.mdaemon.com/MDaemon/en/ssl_white-list.html)** to specify hosts and addresses that must, or must not, use STARTTLS.   ## What are the differences between SSL and TLS? TLS is the successor to SSL. It was introduced in 1999 as an upgrade to SSL 3.0. TLS 1.0 is so similar to SSL 3.0 that it was sometimes called “SSL 3.1”, but the two are not interoperable. The SSL protocol came in versions 2.0 and 3.0, while TLS has progressed through 1.0, 1.1, 1.2, and 1.3 (the current version). Because the protocols aren’t interoperable, the client and server negotiate which one to use at the start of the handshake. Older guidance used to suggest “falling back” to SSL 3.0 when a newer protocol wasn’t available. That advice is now obsolete and unsafe, since SSL 3.0 is broken (more on that below). Without getting too deep into the technical weeds, the main improvements TLS introduced over SSL are: - **More detailed alerts.** TLS defines a richer set of alert and error messages than SSL did, which makes connection problems easier to diagnose. - **Stronger message authentication.** TLS uses HMAC to verify that a message hasn’t been altered in transit, which works with a wider range of hash functions than SSL’s older MAC approach. - **Modernized cipher suites.** TLS supports a different and stronger set of [cipher suites](https://en.wikipedia.org/wiki/Cipher_suite) - the combinations of key exchange, authentication, encryption, and integrity algorithms used to secure a connection. TLS 1.3 in particular removed every legacy, weak option and keeps only a small set of strong, modern ones. ## Why are SSL and TLS important? Businesses have a responsibility to protect financial data such as credit card information, along with consumer records like names, addresses, phone numbers, and medical information. Without some form of encryption, whether an encrypted connection using TLS, or encrypting the message itself with a tool like OpenPGP, sensitive data can be vulnerable to interception and other forms of unauthorized access.   ## Which version is recommended? A lot has changed since the early days of SSL, and several older protocols are now considered unsafe: - **SSL 2.0 and SSL 3.0 are obsolete and should be disabled.** SSL 3.0 in particular suffers from the well-known [POODLE vulnerability](https://www.openssl.org/~bodo/ssl-poodle.pdf) (Padding Oracle On Downgraded Legacy Encryption). SSL 2.0 was deprecated back in 2011, and SSL 3.0 in 2015. - **TLS 1.0 and TLS 1.1 are also deprecated.** The major browsers disabled them in 2020, and the IETF formally retired them in RFC 8996 in 2021. Most compliance frameworks (such as PCI DSS) no longer permit them. Our recommendation: **use TLS 1.2 as a minimum, and prefer TLS 1.3 wherever it’s supported.** TLS 1.3 is the current standard. It’s faster, drops all the old weak algorithms, and builds in protections like forward secrecy by default. Running TLS 1.3 with TLS 1.2 available as a fallback for older clients is today’s best practice. On Windows, the protocols and ciphers that MDaemon and SecurityGateway can use depend on the operating system, and they’re controlled through the Windows registry. A simple way to enable the right protocols and disable the obsolete ones is the free **IIS Crypto** tool, which sets the appropriate registry keys for you: [https://www.nartac.com/Products/IISCrypto](https://www.nartac.com/Products/IISCrypto)   ## Going further: protecting mail between servers Encrypting the connection is the foundation, but two newer standards build on top of TLS to make *server-to-server* email delivery considerably more trustworthy. Both are supported natively in MDaemon and SecurityGateway. **MTA-STS (Mail Transfer Agent Strict Transport Security - RFC 8461).** STARTTLS between mail servers is opportunistic, which means an attacker who can tamper with the connection could downgrade it to plain text. MTA-STS lets your domain publish a policy stating that other servers *must* use TLS with a valid certificate when sending mail to you. The policy is published two ways for tamper-resistance: a DNS TXT record at \_mta-sts.yourdomain.com and a policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Policies run in one of three modes: none, testing (failures are reported but mail still flows), and enforce (mail is refused if TLS can’t be negotiated securely). It pairs naturally with **TLS Reporting (TLS-RPT, RFC 8460)**, which sends you daily reports of any TLS negotiation failures, so the recommended rollout is to start in testing mode, watch the reports, and switch to enforce once you’re confident nothing legitimate is failing. From our knowledge base: - [How to configure MTA-STS in MDaemon](https://knowledge.mdaemon.com/setup-mta-sts-in-mdaemon) - [How to configure MTA-STS in  SecurityGateway](https://knowledge.mdaemon.com/setup-mta-sts-in-securitygateway) **RequireTLS (RFC 8689).** Where MTA-STS is a policy you publish for *incoming* mail, RequireTLS works at the level of an *individual outgoing message*. You can flag a specific, sensitive message so that it will *only* be delivered over a verified TLS connection; and if that’s not possible, the message bounces back to the sender rather than being sent in the clear. In MDaemon, a message is flagged for RequireTLS treatment with a Content Filter rule action or by addressing it to a +requiretls@yourdomain.com style address. (For this to work, the recipient’s mail server must support RequireTLS and its MX must be validated via DNSSEC or MTA-STS.) It’s a useful tool when delivery of a particular message should never happen unless it can happen securely. ![Comparison table of SSL, TLS, STARTTLS, RequireTLS, and MTA-STS email encryption methods showing how each secures server-to-server email](https://blog.mdaemon.com/hs-fs/hubfs/Encryption-method-infographic_SSL-TLS-MTA-STS.jpg?width=711&height=433&name=Encryption-method-infographic_SSL-TLS-MTA-STS.jpg) Together, STARTTLS/implicit TLS encrypt the connection, MTA-STS prevents inbound connections from being quietly downgraded, and RequireTLS lets you guarantee secure delivery on your most sensitive outbound messages. I hope this helps clear up any questions about SSL and TLS, and which encryption options are recommended. As always, if you have questions or comments, let us know! Tags: [Email Security](https://blog.mdaemon.com/topic/email-security), [Email Encryption](https://blog.mdaemon.com/topic/email-encryption), [Email Security Best Practices](https://blog.mdaemon.com/topic/email-security-best-practices), [Two-Factor Authentication](https://blog.mdaemon.com/topic/two-factor-authentication), [Email Security Trends](https://blog.mdaemon.com/topic/email-security-trends), [Email Best Practices](https://blog.mdaemon.com/topic/email-best-practices) ![Brad Wyro](https://blog.mdaemon.com/hs-fs/hubfs/Brad-2023v2.jpg?width=100&height=100&name=Brad-2023v2.jpg) #### Written by [Brad Wyro](https://blog.mdaemon.com/author/brad-wyro) Brad has worked in technical and marketing roles at MDaemon Technologies, where he contributes as Content Marketing Manager. Brad balances technical and creative information to develop easy to understand videos and content to educate prospects and customers. [![BACK TO ALL ARTICLES](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/6572702/05b24dbb-70a6-4eaa-9507-321cb27f7228.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/6572702/05b24dbb-70a6-4eaa-9507-321cb27f7228) ### Subscribe to Email Updates - [Popular](https://blog.mdaemon.com/ssl-tls-best-practices#tab-2) - [Recent](https://blog.mdaemon.com/ssl-tls-best-practices#tab-1) - [Categories](https://blog.mdaemon.com/ssl-tls-best-practices#tab-3) ### Lists by Topic - [Email Security (72)](https://blog.mdaemon.com/tag/email-security) - [MDaemon Email Server (44)](https://blog.mdaemon.com/tag/mdaemon-email-server) - [Email How To (36)](https://blog.mdaemon.com/tag/email-how-to) - [Email Best Practices (29)](https://blog.mdaemon.com/tag/email-best-practices) - [Phishing (28)](https://blog.mdaemon.com/tag/phishing) - [Product Updates (28)](https://blog.mdaemon.com/tag/product-updates) - [Security Gateway for Email (27)](https://blog.mdaemon.com/tag/security-gateway-for-email) - [Stop Spam Email (25)](https://blog.mdaemon.com/tag/stop-spam-email) - [Cybersecurity (24)](https://blog.mdaemon.com/tag/cybersecurity) - [Email Security Best Practices (22)](https://blog.mdaemon.com/tag/email-security-best-practices) - [Email Server (22)](https://blog.mdaemon.com/tag/email-server) - [Two-Factor Authentication (18)](https://blog.mdaemon.com/tag/two-factor-authentication) - [Email Gateway How-To (17)](https://blog.mdaemon.com/tag/email-gateway-how-to) - [Email Security Trends (15)](https://blog.mdaemon.com/tag/email-security-trends) - [Health Care Security (12)](https://blog.mdaemon.com/tag/health-care-security) - [SecurityGateway (12)](https://blog.mdaemon.com/tag/securitygateway) - [Spear Phishing (12)](https://blog.mdaemon.com/tag/spear-phishing) - [Data Leak Prevention (11)](https://blog.mdaemon.com/tag/data-leak-prevention) - [Email Encryption (11)](https://blog.mdaemon.com/tag/email-encryption) - [Anti-Spoofing (10)](https://blog.mdaemon.com/tag/anti-spoofing) - [MDaemon Webmail (10)](https://blog.mdaemon.com/tag/mdaemon-webmail) - [Email Archiving (8)](https://blog.mdaemon.com/tag/email-archiving) - [Email Management (8)](https://blog.mdaemon.com/tag/email-management) - [Email Privacy (8)](https://blog.mdaemon.com/tag/email-privacy) - [Email Spoofing (8)](https://blog.mdaemon.com/tag/email-spoofing) - [Business Email Compromise (7)](https://blog.mdaemon.com/tag/business-email-compromise) - [Anti-Virus (6)](https://blog.mdaemon.com/tag/anti-virus) - [Email Software (6)](https://blog.mdaemon.com/tag/email-software) - [Tutorial (6)](https://blog.mdaemon.com/tag/tutorial) - [Update (6)](https://blog.mdaemon.com/tag/update) - [Collaboration (5)](https://blog.mdaemon.com/tag/collaboration) - [Email Authentication (5)](https://blog.mdaemon.com/tag/email-authentication) - [Compliance (4)](https://blog.mdaemon.com/tag/compliance) - [Email Remote Administration (4)](https://blog.mdaemon.com/tag/email-remote-administration) - [MailStore Archive Server (4)](https://blog.mdaemon.com/tag/mailstore-archive-server) - [Microsoft 365 Exchange Alternative (4)](https://blog.mdaemon.com/tag/microsoft-365-exchange-alternative) - [Passwords (4)](https://blog.mdaemon.com/tag/passwords) - [Software update (4)](https://blog.mdaemon.com/tag/software-update) - [Archive (3)](https://blog.mdaemon.com/tag/archive) - [Attachments (2)](https://blog.mdaemon.com/tag/attachments) - [Business Email (2)](https://blog.mdaemon.com/tag/business-email) - [Cloud (2)](https://blog.mdaemon.com/tag/cloud) - [DMARC (2)](https://blog.mdaemon.com/tag/dmarc) - [Industry Insight (2)](https://blog.mdaemon.com/tag/industry-insight) - [MDaemon (2)](https://blog.mdaemon.com/tag/mdaemon) - [insider threats (2)](https://blog.mdaemon.com/tag/insider-threats) - [msp (2)](https://blog.mdaemon.com/tag/msp) - [Anti-Relay (1)](https://blog.mdaemon.com/tag/anti-relay) - [BEC (1)](https://blog.mdaemon.com/tag/bec) - [Backscatter (1)](https://blog.mdaemon.com/tag/backscatter) - [Bayesian Learning (1)](https://blog.mdaemon.com/tag/bayesian-learning) - [Content Filter (1)](https://blog.mdaemon.com/tag/content-filter) - [DNS-BL (1)](https://blog.mdaemon.com/tag/dns-bl) - [Disaster Recovery (1)](https://blog.mdaemon.com/tag/disaster-recovery) - [Email Collaboration (1)](https://blog.mdaemon.com/tag/email-collaboration) - [Email Software Reviews (1)](https://blog.mdaemon.com/tag/email-software-reviews) - [Encrypt (1)](https://blog.mdaemon.com/tag/encrypt) - [External Email Threats (1)](https://blog.mdaemon.com/tag/external-email-threats) - [Gateway (1)](https://blog.mdaemon.com/tag/gateway) - [Inbox (1)](https://blog.mdaemon.com/tag/inbox) - [Inbox Zero (1)](https://blog.mdaemon.com/tag/inbox-zero) - [Macros (1)](https://blog.mdaemon.com/tag/macros) - [Monitoring (1)](https://blog.mdaemon.com/tag/monitoring) - [Quarantine (1)](https://blog.mdaemon.com/tag/quarantine) - [RelayFax (1)](https://blog.mdaemon.com/tag/relayfax) - [Software (1)](https://blog.mdaemon.com/tag/software) - [Training (1)](https://blog.mdaemon.com/tag/training) - [Upgrade (1)](https://blog.mdaemon.com/tag/upgrade) - [Windows Server (1)](https://blog.mdaemon.com/tag/windows-server) - [internal email threat (1)](https://blog.mdaemon.com/tag/internal-email-threat) - [ssl (1)](https://blog.mdaemon.com/tag/ssl) - [tax scams (1)](https://blog.mdaemon.com/tag/tax-scams) see all ### Posts by Topic - [Email Security (72)](https://blog.mdaemon.com/tag/email-security) - [MDaemon Email Server (44)](https://blog.mdaemon.com/tag/mdaemon-email-server) - [Email How To (36)](https://blog.mdaemon.com/tag/email-how-to) - [Email Best Practices (29)](https://blog.mdaemon.com/tag/email-best-practices) - [Phishing (28)](https://blog.mdaemon.com/tag/phishing) - [Product Updates (28)](https://blog.mdaemon.com/tag/product-updates) - [Security Gateway for Email (27)](https://blog.mdaemon.com/tag/security-gateway-for-email) - [Stop Spam Email (25)](https://blog.mdaemon.com/tag/stop-spam-email) - [Cybersecurity (24)](https://blog.mdaemon.com/tag/cybersecurity) - [Email Security Best Practices (22)](https://blog.mdaemon.com/tag/email-security-best-practices) - [Email Server (22)](https://blog.mdaemon.com/tag/email-server) - [Two-Factor Authentication (18)](https://blog.mdaemon.com/tag/two-factor-authentication) - [Email Gateway How-To (17)](https://blog.mdaemon.com/tag/email-gateway-how-to) - [Email Security Trends (15)](https://blog.mdaemon.com/tag/email-security-trends) - [Health Care Security (12)](https://blog.mdaemon.com/tag/health-care-security) - [SecurityGateway (12)](https://blog.mdaemon.com/tag/securitygateway) - [Spear Phishing (12)](https://blog.mdaemon.com/tag/spear-phishing) - [Data Leak Prevention (11)](https://blog.mdaemon.com/tag/data-leak-prevention) - [Email Encryption (11)](https://blog.mdaemon.com/tag/email-encryption) - [Anti-Spoofing (10)](https://blog.mdaemon.com/tag/anti-spoofing) - [MDaemon Webmail (10)](https://blog.mdaemon.com/tag/mdaemon-webmail) - [Email Archiving (8)](https://blog.mdaemon.com/tag/email-archiving) - [Email Management (8)](https://blog.mdaemon.com/tag/email-management) - [Email Privacy (8)](https://blog.mdaemon.com/tag/email-privacy) - [Email Spoofing (8)](https://blog.mdaemon.com/tag/email-spoofing) - [Business Email Compromise (7)](https://blog.mdaemon.com/tag/business-email-compromise) - [Anti-Virus (6)](https://blog.mdaemon.com/tag/anti-virus) - [Email Software (6)](https://blog.mdaemon.com/tag/email-software) - [Tutorial (6)](https://blog.mdaemon.com/tag/tutorial) - [Update (6)](https://blog.mdaemon.com/tag/update) - [Collaboration (5)](https://blog.mdaemon.com/tag/collaboration) - [Email Authentication (5)](https://blog.mdaemon.com/tag/email-authentication) - [Compliance (4)](https://blog.mdaemon.com/tag/compliance) - [Email Remote Administration (4)](https://blog.mdaemon.com/tag/email-remote-administration) - [MailStore Archive Server (4)](https://blog.mdaemon.com/tag/mailstore-archive-server) - [Microsoft 365 Exchange Alternative (4)](https://blog.mdaemon.com/tag/microsoft-365-exchange-alternative) - [Passwords (4)](https://blog.mdaemon.com/tag/passwords) - [Software update (4)](https://blog.mdaemon.com/tag/software-update) - [Archive (3)](https://blog.mdaemon.com/tag/archive) - [Attachments (2)](https://blog.mdaemon.com/tag/attachments) - [Business Email (2)](https://blog.mdaemon.com/tag/business-email) - [Cloud (2)](https://blog.mdaemon.com/tag/cloud) - [DMARC (2)](https://blog.mdaemon.com/tag/dmarc) - [Industry Insight (2)](https://blog.mdaemon.com/tag/industry-insight) - [MDaemon (2)](https://blog.mdaemon.com/tag/mdaemon) - [insider threats (2)](https://blog.mdaemon.com/tag/insider-threats) - [msp (2)](https://blog.mdaemon.com/tag/msp) - [Anti-Relay (1)](https://blog.mdaemon.com/tag/anti-relay) - [BEC (1)](https://blog.mdaemon.com/tag/bec) - [Backscatter (1)](https://blog.mdaemon.com/tag/backscatter) - [Bayesian Learning (1)](https://blog.mdaemon.com/tag/bayesian-learning) - [Content Filter (1)](https://blog.mdaemon.com/tag/content-filter) - [DNS-BL (1)](https://blog.mdaemon.com/tag/dns-bl) - [Disaster Recovery (1)](https://blog.mdaemon.com/tag/disaster-recovery) - [Email Collaboration (1)](https://blog.mdaemon.com/tag/email-collaboration) - [Email Software Reviews (1)](https://blog.mdaemon.com/tag/email-software-reviews) - [Encrypt (1)](https://blog.mdaemon.com/tag/encrypt) - [External Email Threats (1)](https://blog.mdaemon.com/tag/external-email-threats) - [Gateway (1)](https://blog.mdaemon.com/tag/gateway) - [Inbox (1)](https://blog.mdaemon.com/tag/inbox) - [Inbox Zero (1)](https://blog.mdaemon.com/tag/inbox-zero) - [Macros (1)](https://blog.mdaemon.com/tag/macros) - [Monitoring (1)](https://blog.mdaemon.com/tag/monitoring) - [Quarantine (1)](https://blog.mdaemon.com/tag/quarantine) - [RelayFax (1)](https://blog.mdaemon.com/tag/relayfax) - [Software (1)](https://blog.mdaemon.com/tag/software) - [Training (1)](https://blog.mdaemon.com/tag/training) - [Upgrade (1)](https://blog.mdaemon.com/tag/upgrade) - [Windows Server (1)](https://blog.mdaemon.com/tag/windows-server) - [internal email threat (1)](https://blog.mdaemon.com/tag/internal-email-threat) - [ssl (1)](https://blog.mdaemon.com/tag/ssl) - [tax scams (1)](https://blog.mdaemon.com/tag/tax-scams) See all #### About MDaemon Technologies MDaemon Technologies is a pioneer in developing email and email security software helping to protect customers from evolving cyber-security threats. Its products and services are trusted by thousands of organizations in over 140 countries. For more than two decades, the company’s products have been developed with the ongoing input of IT professionals who demand reliable, affordable software that requires minimal effort to manage. The software can be deployed in virtual, hosted cloud, on-premises, or hybrid network environments. The company sells its software and services directly and through a network of global channel partners. For more information, visit [www.mdaemon.com](https://www.altn.com/). Copyright © 1996-2026 MDaemon Technologies.  View [privacy policy](https://mdaemon.com/policies/privacy-policy).   ###### Contact Us +1.817-601-3222 [sales@help.mdaemon.com](mailto:sales@help.mdaemon.com) 6340 Lake Worth Blvd. Fort Worth, TX 76135 ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Brad Wyro", "url" : "https://blog.mdaemon.com/author/brad-wyro" }, "dateModified" : "2026-07-15T17:33:20.225Z", "datePublished" : "2016-08-11T17:04:02.000Z", "headline" : "Protect sensitive data in email: SSL & TLS Best Practices", "image" : [ "https://blog.mdaemon.com/hubfs/Email_Encryption_SSL_TLS_Guide.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.mdaemon.com/ssl-tls-best-practices", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.mdaemon.com/hubfs/MDaemon-Technologies_logo_large.png" }, "name" : "MDaemon Technologies" } } ```