The Myth
Most people believe Outlook encrypts all outgoing emails automatically — especially if they’re logged into a work or school Microsoft 365 account. They’ll tell you: 'It’s built into Exchange,' or 'Microsoft handles it behind the scenes.' Some even point to the little lock icon next to the To field and say, 'See? It’s secure.'That lock icon means exactly one thing: Outlook has verified the recipient’s email address format. It says nothing about encryption. Zero. Not TLS. Not S/MIME. Not Microsoft Purview Message Encryption (formerly OME). It’s just syntax validation.
I’ve seen this trip up even experienced users — including an IT director who sent payroll data to a vendor’s Gmail address assuming ‘Outlook + M365 = automatic encryption.’ It wasn’t.
The Reality
Outlook does not encrypt emails by default — ever. Not in Outlook 2016, not in Outlook 2019, not in Outlook for Microsoft 365 (desktop or web), and not on macOS.Here’s what does happen:
- TLS encryption is attempted during SMTP delivery — but only if the recipient’s mail server supports it, and only for the transport leg (server-to-server). You have no control over this, and no visibility unless you check message headers.
- S/MIME encryption requires both sender and recipient to exchange and install digital certificates first. It’s off by default, and Outlook won’t enable it unless you manually configure it — and then only for specific messages (Ctrl+Alt+E).
- Microsoft Purview Message Encryption (OME) requires admin-level policy setup in the Microsoft 365 compliance center — and even then, it only applies when a rule triggers (e.g., subject contains ‘Confidential’ or attachment is a .xlsx file).
So yes — your email might get TLS-encrypted in transit. But the message body sits unencrypted on both your Exchange mailbox and the recipient’s inbox (unless they also use S/MIME or have OME policies applied on their end).
Why the Myth Persists
This confusion started years ago — back when Outlook 2007 shipped with S/MIME enabled by default if you had a certificate installed. But that was opt-in during setup, and most users skipped it. Still, early documentation implied ‘encryption is ready when you are.’Then came Office 365 (2013–2016 era), where marketing materials said ‘built-in security’ — never clarifying that ‘built-in’ meant ‘available if configured,’ not ‘active out-of-the-box.’
Today’s problem? Outdated blog posts from 2018 still rank highly. They say ‘go to File > Options > Trust Center > Email Security and check “Encrypt contents and attachments”’ — but that checkbox only applies to new S/MIME messages you manually encrypt. It doesn’t toggle default behavior.
Also: Outlook for Mac hides the S/MIME options entirely unless you install a third-party certificate manager — another source of version-based confusion.
The Right Way
If you need guaranteed encryption for sensitive emails, here’s how to set it up properly — step-by-step for Windows and Mac:For S/MIME (sender & recipient both need certs):
• Get a valid S/MIME certificate (e.g., from DigiCert or Sectigo)
• Install it in Windows Certificate Manager (certmgr.msc) or Keychain Access (Mac)
• In Outlook: File > Options > Trust Center > Trust Center Settings > Email Security
• Under ‘Encrypted email,’ click ‘Settings’ → ensure ‘Encrypt contents and attachments for outgoing messages’ is unchecked (yes — leave it off. Default encryption breaks replies from non-S/MIME users.)
• Instead, use Ctrl+Alt+E before sending each sensitive message.
For Microsoft Purview Message Encryption (M365 tenants only):
• Your admin must go to compliance.microsoft.com > Solutions > Information Protection > Mail Flow Rules and create a rule (e.g., ‘If subject contains “HR – Salary” → apply OME template “Do Not Forward”’)
• Once deployed, you’ll see ‘Encrypted’ appear next to the subject line after sending — but only if the rule matched.
On Mac: S/MIME works, but the UI is buried. Go to Outlook > Preferences > Security > S/MIME Settings. No keyboard shortcut exists — you must click the padlock icon in the compose window.
Proof It Works
Here’s a real-world test we ran last week across three accounts:| Test Scenario | Outlook Version | Result (View Source) | Encryption Active? |
|---|---|---|---|
| Plain send to Gmail | Outlook 365 (v2405) | Received-SPF: pass... X-Microsoft-Antispam: ... no encryption headers | No |
| Ctrl+Alt+E to same Gmail | Outlook 365 (v2405) | Content-Type: application/pkcs7-mime; smime-type=enveloped-data | Yes (S/MIME) |
| Subject: ‘Legal – NDA’ + OME rule active | Outlook Web App | X-MS-OME-Enabled: true, X-MS-OME-Original-Sender: … | Yes (OME) |
| Send to internal colleague (no rules) | Outlook 2019 | X-MS-Exchange-Organization-ExpirationInterval: … no OME or S/MIME headers | No |
| Reply to encrypted OME message | Outlook for Mac (v16.85) | X-MS-OME-Original-Sender: … + Content-Type: text/html; charset=utf-8 | Yes (thread inherits OME) |
Notice: Only manual actions (Ctrl+Alt+E) or policy-triggered sends show evidence of encryption in headers. Everything else is plaintext in transit and at rest.
Exceptions
There are two narrow cases where Outlook *does* encrypt by default — but neither is about email content:• When you attach a file from OneDrive or SharePoint that’s protected with sensitivity labels (e.g., ‘Confidential – Finance’), Outlook adds a permissions wrapper — but the email body remains unencrypted.
• If your organization uses Microsoft Defender for Office 365 with ‘Safe Attachments’ enabled, Outlook may rewrite links and scan attachments — but again, this isn’t message encryption.
Also: Outlook Mobile (iOS/Android) displays a lock icon next to recipients in your organization — but that only confirms Azure AD identity matching, not encryption status.
So no — there is no version, configuration, or tenant setting where ‘does outlook encrypt emails by default’ becomes ‘yes’ for the full message.
Next step: Open Outlook right now and run this 30-second check. Compose a new message to yourself. Before sending, press Ctrl+Alt+E. If the lock icon turns green and the subject line gains ‘(Encrypted)’, S/MIME is working. If nothing changes — it’s not configured. Don’t assume. Verify.
