How to send secure email in Outlook: encryption, authentication, and domain protection

When you send sensitive information by email, you need to know two things: Can anyone else read the message, and can the recipient trust that it really came from you?

Outlook gives you tools to help protect the message itself, including encryption and S/MIME. But securing email doesn’t end once the contents are encrypted. Attackers can still impersonate your organization, spoof your domain, and send phishing emails that look legitimate.

The practical takeaway is simple: Secure email requires protecting both the message and the identity behind it. In this guide, you’ll learn how to secure messages in Outlook and how technologies like SPF, DKIM, and DMARC help protect your domain from impersonation and email fraud.

What does "secure email" mean in Outlook? 

Secure email isn't a single feature. It combines several protections that work together to keep messages private, verify sender identity, and reduce the risk of phishing, spoofing, and unauthorized access.

For example, encryption can help ensure only the intended recipient can read a message, while authentication technologies can help verify that the message actually came from your organization.

Outlook supports several security mechanisms, each playing a different role in a broader email security strategy. 

How to send an encrypted email in Outlook 

Outlook offers a few ways to secure message content, depending on your organization's Microsoft 365 configuration and security requirements.

Microsoft 365 Message Encryption 

Microsoft 365 Message Encryption lets you send encrypted messages directly from Outlook.

Here’s how to manually encrypt a message in Outlook:

1. Create a new email message.
2. Select Options.
3. Choose Encrypt.
4. Select the appropriate encryption setting.
5. Send the message.

Recipients can securely access the message even if they use a different email provider.

S/MIME encryption 

S/MIME uses digital certificates to encrypt and digitally sign email messages. Unlike Microsoft 365 Message Encryption, which is managed through Microsoft’s cloud services, S/MIME relies on certificates installed and managed by senders and recipients.

Organizations often use S/MIME in highly regulated environments or when they need stronger sender verification in addition to message protection. Because S/MIME requires certificate management and configuration on both sides of the conversation, it can be more complex to deploy and maintain than other encryption options.

S/MIME protects message content and helps verify sender identity, but it doesn’t prevent attackers from spoofing your domain or sending fraudulent messages that appear to come from your organization. That’s why it works best as one layer in a broader email security strategy.

Rights management and "Do Not Forward" 

Encryption controls who can access a message. Rights management controls what authorized recipients can do with it after they receive it.

Outlook supports permissions-based protections through Microsoft Purview Information Protection and related Microsoft 365 controls. Depending on your configuration, you can apply policies such as:

• Do Not Forward
• Confidential
• View Only

These controls can help reduce accidental sharing by restricting actions such as forwarding, copying, printing, or downloading content.

They’re designed to reduce risk, not eliminate it. An authorized recipient may still be able to capture information through screenshots, photographs, or other means. For that reason, rights management works best alongside encryption, authentication, and user awareness training.

When should you use encrypted Email? 

Not every email requires encryption, but it's good practice whenever you’re sending sensitive or regulated information, such as: 

• Financial information: invoices, payment details, tax records, and banking information
• Legal documents: contracts, agreements, compliance documentation, and privileged communications
• Human resources communications: employee records, compensation details, performance reviews, and hiring information
• Customer data: personally identifiable information (PII), account details, and support records
• Healthcare and other regulated information: protected health information and other regulated data subject to industry requirements.

Encryption protects message content, not your domain 

Encryption protects message confidentiality, but it doesn’t prevent attackers from impersonating your organization.

For example, a cybercriminal can create a fraudulent email that appears to come from your company's domain and send it to customers, partners, or employees. The message may not have come from your systems at all, yet recipients could still believe it’s legitimate.

That’s why secure email requires both message security and domain security. One protects the content of legitimate email, while the other protects the identity behind it.

Why SPF, DKIM, and DMARC matter for secure email 

Receiving mail providers also need a way to verify that messages come from authorized sources.

That's where SPF, DKIM, and DMARC come in:

Together, they create multiple layers of validation: SPF verifies where a message came from, DKIM helps verify its integrity, and DMARC ties those checks together while providing enforcement and reporting capabilities.

No single control can stop every attack. By combining encryption, authentication, and domain protection, you can help reduce the risk of phishing, spoofing, and email fraud while improving trust in legitimate communications.

How domain authentication helps prevent email spoofing 

Email spoofing works because the recipient sees a familiar sender name or domain and assumes the message is legitimate. Without authentication controls, receiving mail systems may have a harder time distinguishing legitimate email from messages sent by an attacker.

Domain authentication helps close that gap. By giving mailbox providers a reliable way to verify whether a message is authorized to use your domain, you can reduce the likelihood that fraudulent messages reach employees, customers, or business partners.

When SPF, DKIM, and DMARC are implemented correctly, they can help reduce unauthorized use of your domain.

This helps:

• Protect customers from phishing
• Reduce brand impersonation
• Improve trust in legitimate communications
• Increase visibility into unauthorized email activity 

Outlook security best practices for businesses 

Effective email security depends on multiple layers of protection, from securing accounts and sensitive messages to verifying sender identity and reducing the risk of phishing and spoofing. 

Whether you're a small business or a large enterprise, these best practices can help strengthen your overall email security and make the most of Outlook's built-in security capabilities.

Use these best practices to strengthen email security in Outlook:

• Use encryption when appropriate: Enable Microsoft 365 Message Encryption or S/MIME for sensitive communications. 
• Require multi-factor authentication: MFA helps prevent account compromise, even when passwords are exposed.
• Train employees to recognize phishing attempts: Technology alone can’t stop every attack. Ongoing security awareness training remains essential.
• Monitor domain reputation: Regularly review email performance, authentication results, and domain health.
• Implement SPF, DKIM, and DMARC: Foundational controls help verify legitimate email and prevent domain abuse. 
• Move toward DMARC enforcement: Monitoring mode gives you visibility, while quarantine and reject policies provide stronger protection against spoofing.

Strengthen your email security from message to domain 

Secure email depends on protecting both the message and the identity behind it. Encryption, digital signatures, and rights management help safeguard sensitive information, while authentication technologies help receiving mail systems distinguish legitimate email from impersonation and spoofing.

DigiCert supports that trust at both levels. For organizations using S/MIME, digital certificates help verify sender identity and protect message integrity. At the domain level, SPF, DKIM, and DMARC help protect your organization’s email identity.

Now included in Digicert ONE and Digicert UltraDNS, Valimail’s DMARC monitoring makes it easier to deploy, monitor, and enforce DMARC across complex email environments. The result: full visibility into authentication activity and stronger protection against spoofing and impersonation.

Together, these technologies create a more complete approach to email security—one that protects both the messages you send and the trust behind them.