for the sake of simplicity i want to visualize the dangers of sending an unencrypted e-mail. I'm just not sure WHO can read unencrypted e-mails.
Lets say i'm using Office365 as mail provider and i send an e-mail using my local Outlook client. The mail is send and received using Office365 mailserver and both sender and receiver use an third party spam filter solution.
Now i would suspect that the mail goes through the following hubs:
- Local mail client to ISP
- ISP to Office365
- Office365 to ISP (spamfilter)
- ISP to spamfilter (sender)
- Spamfilter to ISP (ISP spamfilter receiver)
- ISP to spamfilter (receiver)
- Spamfilter to ISP (office365)
- Office365 to ISP (receiver)
- ISP to local mail client
According to my knowledge the network traffic between all these hosts is encrypted by TLS. This would mean an ISP could only decrypt the mail send from Office365 to the spamfilter (step 3 and 4) if they intercept the certificates using MITM techniques.
if i'm right the only external parties in this mail during transfer who would be able the read the content of the mail would be mail- and spamfilter providers due to the nature of their service, right?