Glossary · Security
S/MIME uses personal certificates to digitally sign email and encrypt it end to end, so only the intended recipient can read it.
Each person gets an X.509 certificate from a certificate authority (RFC 8551). Signing proves the message came from the certificate holder and wasn't altered. Encrypting uses the recipient's certificate, so you need theirs before you can send them encrypted mail.
It's built into Outlook and Apple Mail and common in regulated industries. It's different from DKIM, which the sending server applies for the whole domain and which doesn't encrypt anything.
Every domain you run in one inbox, from $3 a mailbox. 14 days free, no card.