Knowledge Base

How to exchange S/MIME encrypted email

Updated on September 26, 2026

Overview

By following this article, you will be able to send and receive encrypted email with a contact by using Secure/Multipurpose Internet Mail Extensions (S/MIME). Before you can encrypt email to someone, you and your contact must each have the other's public key. You get it by exchanging digitally signed emails. This article covers the requirements, the three steps to exchange signed emails and start encrypting, how to keep S/MIME working, how email disclaimers can break S/MIME, troubleshooting, and an email template you can send to your contact.

Requirements for S/MIME encrypted email

Before you exchange Secure/Multipurpose Internet Mail Extensions (S/MIME) encrypted email, make sure you have:

An S/MIME email certificate installed on the device or email account that you use.
A certificate from a public Certificate Authority (CA), if possible, so that most email systems trust it automatically.
An email application that supports S/MIME, such as Microsoft Outlook.

Your contact needs the same things.

Steps to exchange S/MIME encrypted email

Step 1 — Send a digitally signed email to your contact

To share your Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate, which contains your public key, send your contact a signed email:

Create a new email to your contact.
In your email application, turn on the Sign (S/MIME) option.
Send the email.

Your contact's email application stores your certificate and public key.

Step 2 — Receive a digitally signed reply from your contact

To get your contact's public key, ask your contact to reply to your signed email with a digitally signed email of their own. When the signed reply arrives, your email application stores your contact's Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate and public key.

Step 3 — Send an encrypted email

After you and your contact have exchanged signed emails, you can send Secure/Multipurpose Internet Mail Extensions (S/MIME) encrypted email:

Create a new email to your contact.
Turn on the Encrypt (S/MIME) option. We recommend that you also turn on Sign.
Send the email.

Only a recipient who has the matching private key can decrypt and read the email.

How to keep S/MIME email working

To keep Secure/Multipurpose Internet Mail Extensions (S/MIME) encrypted email working:

Renew your S/MIME email certificate before it expires.
If you change devices or lose access, restore your certificate and private key from a backup, or use your organization's key recovery process. Without the private key, you cannot read email that was encrypted before.

How email disclaimers affect S/MIME

If an email server adds a disclaimer, confidentiality banner, or other legal text after you send a Secure/Multipurpose Internet Mail Extensions (S/MIME) email, the recipient's email application can treat the change as tampering, and the email can show as invalid. To prevent this:

Turn off automatic banners for S/MIME signed or encrypted email, or
Put any required legal text in your normal email signature, so that it is included before you sign the email.

Troubleshooting S/MIME encrypted email

Issue	Cause	Solution
You cannot encrypt email to your contact.	You do not have your contact's public key.	Ask your contact to send you a digitally signed email.
The signature shows as invalid or tampered.	An email server changed the email after it was sent, for example by adding a disclaimer.	Turn off automatic banners for S/MIME signed or encrypted email.
You cannot open an encrypted email.	The private key is not on your device or account.	Restore the private key from a backup, or contact your IT (information technology) team.
Your certificate expired.	S/MIME email certificates are valid for a limited time.	Renew the certificate, and then send your contact a new signed email so that they have your new public key.

Email template to request an S/MIME key exchange

You can send this text in your signed email (Step 1) to ask your contact for a signed reply:

Subject: Exchanging S/MIME keys for encrypted email

Hi,

This email is digitally signed so that you can store my S/MIME certificate and public key. Please reply with a digitally signed email so that I can store yours. After we exchange signed emails, we can send each other encrypted email.

Thank you.