Is your email filtered abroad? Who can read business mail on the way

Most business email passes through at least one filtering service on its way to the inbox, and that service may run in another country. To catch spam and viruses, a filter has to read each message, so a readable copy exists wherever the filtering happens. Encryption between servers protects the connections, not the copies. The only protection that does not depend on every company in the chain is end-to-end encryption, which is why Noiz recommends Thunderbird with OpenPGP.

Your email takes more stops than you think

When someone sends you an email, their mail server looks up your domain's MX records. Those DNS records name the server that accepts mail for you, and the sending server delivers there.

That first server is often not your mailbox at all. Many hosts and businesses point their MX records at a filtering service, which receives the mail, checks it and passes it on to the mailbox server. Hosted filtering services commonly run on global networks. Some let the customer choose a region, which tells you that mail otherwise goes wherever the provider routes it.

You can see the stops for yourself. Every server that handles a message adds a "Received" line to its headers. Our help article on reading full email headers shows where to find them.

What a filter has to do to protect you

A spam and virus filter is valuable. It is also, by design, a system that reads your mail. It receives the whole message, opens it, scores it and decides whether to deliver, hold or reject it.

Filters keep things too:

• Quarantine. Suspicious messages are held so you can release them later.
• Logs. Message tracking records who wrote to whom, when and with what result.
• Archives. Some services keep copies for a set period or for as long as the customer chooses.

None of this is sinister. It is how filtering works. But each filter, quarantine, log and archive is another place where a readable copy of your mail, or a record of your correspondence, exists.

Encryption between servers is not the same as privacy

Most mail servers now encrypt the connection between them using TLS, started with a command called STARTTLS. That stops someone on the network from reading mail as it passes. The standard itself is plain about the limit: TLS protects one hop between two servers, and SMTP is not an end-to-end mechanism. At each server the message arrives readable, because that server has to handle it.

Two newer records strengthen those hops:

• MTA-STS lets a domain require encrypted, authenticated connections to its listed mail servers, so an attacker cannot quietly switch encryption off.
• TLS-RPT sends reports when those connections fail.

Both make the journey harder to attack. Neither hides the message from the servers on the route, including a filter named in your MX records.

Every readable copy is a risk to manage

Where a copy exists, it can be exposed: a breach at the provider, a staff member with too much access, a legal request in the country where the server sits, a retention setting nobody reviewed. These are risks for any provider anywhere, including in South Africa. The question for a business is not whether its providers mean well. It is how many readable copies of its mail exist, where, and under whose control.

That is a security question and a privacy question at the same time. Fewer readable copies means fewer places to lose them.

What POPIA asks of you

The Protection of Personal Information Act (POPIA) applies to most business mail, because email is full of names, addresses and client details.

• Section 19 requires you to secure personal information with appropriate, reasonable technical and organisational measures.
• Sections 20 and 21 cover operators, such as a filtering service that processes mail for you. They must act only with your authorisation, keep the information confidential, and work under a written contract that requires those security measures.
• Section 72 limits transfers of personal information to third parties in other countries to listed grounds, such as adequate protection in that country, a binding agreement or the data subject's consent.

The Information Regulator has not published guidance on whether passing mail through a filter abroad counts as a transfer under section 72. So ask your email provider where your mail is filtered, stored and archived, and under what contract. Noiz is not a law firm; take advice on your own position.

The protection that does not depend on any provider: OpenPGP

End-to-end encryption encrypts a message on your computer and decrypts it only on the recipient's. Every server in between, filters included, handles a sealed message it cannot read.

OpenPGP is the open standard for this, most recently published in July 2024. Each person has a key pair. You publish the public key; the private key never leaves your device. A message encrypted to someone's public key can only be opened with their private key.

OpenPGP does not hide everything:

• Who wrote to whom, and when, stays visible, because servers need it to deliver the mail.
• The subject line may stay readable, depending on the mail program.
• A filter cannot scan an encrypted message for viruses, so be as careful with encrypted attachments as with any other.

Why Noiz recommends Thunderbird

Thunderbird is a free and open-source mail program from Mozilla, and OpenPGP has been built into it since version 78. You do not need a plug-in. It works with any standard IMAP mailbox, including every Noiz mailbox.

Two habits make it safe to use:

• Back up your private key and keep the backup apart from the computer. If the key is lost, mail encrypted to it cannot be recovered by anyone, Noiz included.
• Set a Primary Password in Thunderbird, so the keys stored in your profile are protected.

Before trusting someone's public key, compare its fingerprint with them by phone or in person. That stops an impostor from slipping in a key of their own.

Start small

You do not need to encrypt everything on day one.

1. Create your keys in Thunderbird and back them up. Our guide on setting up OpenPGP keys in Thunderbird walks through it.
2. Sign your everyday mail, so correspondents get your public key and can check your messages are genuine.
3. Encrypt the conversations that carry sensitive information: contracts, identity documents, payroll, client files. Our guide on sending encrypted and signed email shows how.
4. Add your phone with Thunderbird on Android.

The longer explanation of why encryption matters is in our help article on why and how to encrypt your email with OpenPGP. If you are still on Outlook, our earlier article explains why the new Outlook hands your mailbox to Microsoft, and how to switch to Thunderbird.

How Noiz helps

Noiz does not read or mine the mail in your mailbox; the only automated processing is spam and virus filtering at delivery. The Email Security add-on adds advanced filtering, keeps your authentication records configured and signs your DNS zone, and Private Email gives an organisation a mail server run by Noiz and set up for it. For the conversations that matter most, encrypt them: if you would like a hand setting up Thunderbird and OpenPGP, open a ticket and we will help.

Sources

Checked 19 October 2026.

Standards

• RFC 5321, Simple Mail Transfer Protocol
• RFC 3207, SMTP over TLS (STARTTLS)
• RFC 8461, SMTP MTA Strict Transport Security (MTA-STS)
• RFC 8460, SMTP TLS Reporting
• RFC 9580, OpenPGP

Software and filtering

• Mozilla Support, Introduction to end-to-end encryption in Thunderbird
• Mozilla Support, OpenPGP in Thunderbird: HOWTO and FAQ
• Proxmox Mail Gateway administration guide (how an inbound filter receives, quarantines and tracks mail)
• Google Transparency Report, Email encryption in transit

Law

• Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)
• Information Regulator, guidance notes

Noiz

• Email Security add-on
• Email hosting and Private Email
• Help articles linked in the text, on docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.