How can you create a digital signature for email?

Digital sig­na­tures are a proven security measure in elec­tron­ic commerce, par­tic­u­lar­ly as phishing remains one of the biggest security risks for busi­ness­es. With a valid digitally signed email, re­cip­i­ents can verify that the signed content has not been altered and that it was signed using the cor­re­spond­ing private key. How reliably that key iden­ti­fies a person or or­ga­ni­za­tion depends on the cer­tifi­cate and its val­i­da­tion. A phishing email can also carry a valid digital signature; a signature alone does not make a message trust­wor­thy.

Key Takeaways ⓘ

• Digital sig­na­tures help verify the signing key and detect changes to signed email content.
• A valid signature does not make an email trust­wor­thy or rule out phishing.
• S/MIME uses cer­tifi­cate au­thor­i­ties, while OpenPGP uses de­cen­tral­ized key man­age­ment.
• Identity assurance depends on the cer­tifi­cate profile and val­i­da­tion pro­ce­dures, not just the presence of a signature.
• Signing does not encrypt the message; en­cryp­tion provides con­fi­den­tial­i­ty.
• Classic and new Outlook have different settings for importing cer­tifi­cates and signing messages.

What is the purpose of a digital email signature?

A digital email signature confirms that

• the content of an email has arrived unchanged (integrity), and
• the message was signed using the private key as­so­ci­at­ed with the specified address (au­then­tic­i­ty).

A digital email signature provides cryp­to­graph­ic pro­tec­tion. It confirms that the email content has not been altered and helps re­cip­i­ents verify the sender’s identity. However, it does not prevent third parties from reading the message. In Outlook, for example, a signature icon in the message header indicates that the message has been digitally signed, not that the email address itself has been signed.

What does a digital email signature include and why is it important?

With S/MIME, a digital email signature uses a cer­tifi­cate and a cryp­to­graph­ic key pair. The sender uses the private key to sign the message, while the recipient uses the cor­re­spond­ing public key to verify the signature. OpenPGP also uses a key pair, but does not require the same cer­tifi­cate-authority in­fra­struc­ture.

A digital email signature therefore serves two main purposes: it helps verify the signing key and detects changes to the signed message. The strength of identity ver­i­fi­ca­tion depends on the cer­tifi­cate and its val­i­da­tion. This is par­tic­u­lar­ly useful in business email com­mu­ni­ca­tion, but does not by itself rule out phishing attempts, including messages signed using an attacker’s own cer­tifi­cate or a com­pro­mised private key.

Digital sig­na­tures may also have legal sig­nif­i­cance. Depending on the type of signature and the ap­plic­a­ble legal re­quire­ments, they can serve as evidence and help prevent the sender from denying that they signed the message in the event of a dispute.

How do email signature, elec­tron­ic signature, digital email signature and email en­cryp­tion differ?

A digital email signature should not be confused with the per­son­al­ized signature added to the end of a message in an email program. This email signature generally contains contact details and company in­for­ma­tion, but it provides no cryp­to­graph­ic pro­tec­tion.

An elec­tron­ic signature is legally rec­og­nized in the US under the federal Elec­tron­ic Sig­na­tures in Global and National Commerce Act, commonly known as the E-SIGN Act, as well as ap­plic­a­ble state elec­tron­ic trans­ac­tion laws. Most states have adopted leg­is­la­tion based on the Uniform Elec­tron­ic Trans­ac­tions Act (UETA). These laws generally provide that a signature, contract or other record cannot be denied legal effect solely because it is in elec­tron­ic form.

An elec­tron­ic signature can take various forms, including:

• a typed name at the end of an elec­tron­ic document
• a scanned hand­writ­ten signature
• clicking a button to indicate agreement
• a signature created using a dedicated elec­tron­ic signing platform

A digital email signature, by contrast, is a specific cryp­to­graph­ic security measure. It verifies that a message was signed using a par­tic­u­lar private key and allows re­cip­i­ents to detect whether the signed content has been altered. A digital signature may qualify as an elec­tron­ic signature when it is used with the intention of signing a record, but its legal effect depends on the cir­cum­stances and the ap­plic­a­ble federal or state re­quire­ments.

Digital sig­na­tures are also often used alongside email en­cryp­tion. Digitally signing an email helps confirm its origin and protects it against un­de­tect­ed al­ter­ation, but the message itself remains readable. En­crypt­ing emails protects the content so that only au­tho­rized re­cip­i­ents can decrypt and read it. Digital sig­na­tures therefore protect au­then­tic­i­ty and integrity, while en­cryp­tion protects con­fi­den­tial­i­ty.

How do digital email sig­na­tures work?

The basic principle of a digital email signature is based on asym­met­ric cryp­tog­ra­phy (public key method), i.e. a procedure with two as­so­ci­at­ed keys: a private key and a public key. The basic principle is explained step by step below:

1. Creating a hash value: The sender’s email program applies a hash function to the email content, gen­er­at­ing a unique checksum that rep­re­sents the entire message.
2. Signing with the private key: The sender’s private key is used to cryp­to­graph­i­cal­ly sign the hash value. This key remains con­fi­den­tial and serves as the sender’s digital proof of au­thor­ship.
3. Sending the signed email: The digital signature is sent together with the readable email content. The message is not encrypted, but any sub­se­quent changes can be detected.
4. Providing the public key: With S/MIME, the cor­re­spond­ing public key is generally supplied through a cer­tifi­cate attached to the signed email. With OpenPGP, the public key may be exchanged be­fore­hand or made available in a directory.
5. Verifying the signature: On receipt, the recipient’s email program uses the public key to verify the signature and in­de­pen­dent­ly cal­cu­lates a new hash value from the message.
6. Comparing the results: If the newly cal­cu­lat­ed hash matches the value verified from the signature, this confirms that the message was signed with the cor­re­spond­ing private key and was not altered in transit.
7. Verifying the sender’s identity: With S/MIME, the cer­tifi­cate and its val­i­da­tion are checked to assess how reliably the key can be linked to the claimed person, or­ga­ni­za­tion or mailbox. With OpenPGP, this depends on how the recipient has verified the public key.

How is identity verified with a digital email signature?

With S/MIME, different cer­tifi­cate profiles provide different levels of assurance about a mailbox, person or or­ga­ni­za­tion. These technical profiles must not be equated with legal elec­tron­ic-signature levels:

Mailbox or domain val­i­da­tion

This form of ver­i­fi­ca­tion checks whether the applicant controls a specific email address or domain. Common methods include con­firm­ing a link sent by email, adding a DNS record or uploading a file to the domain’s web server.

These cer­tifi­cates are mainly suitable for technical purposes, such as automated system emails or internal com­mu­ni­ca­tion. However, they do not provide reliable proof of a natural person’s identity.

Personal or or­ga­ni­za­tion­al identity ver­i­fi­ca­tion

The level of trust is generally higher when an applicant’s identity is verified before the cer­tifi­cate is issued. Depending on the cer­tifi­cate type and provider, this may involve checking a gov­ern­ment-issued ID, con­duct­ing remote identity ver­i­fi­ca­tion or con­sult­ing au­thor­i­ta­tive business records.

Cer­tifi­cates issued after this type of ver­i­fi­ca­tion can be linked more reliably to a specific person or or­ga­ni­za­tion. They may therefore be par­tic­u­lar­ly useful for business cor­re­spon­dence and com­mu­ni­ca­tions with potential legal sig­nif­i­cance.

Older provider-specific clas­si­fi­ca­tions based on cer­tifi­cate classes 1 through 3 are no longer the relevant standard. In the US, the key factors are the cer­tifi­cate profile, the val­i­da­tion pro­ce­dures used by the cer­tifi­cate authority and any ap­plic­a­ble technical or industry re­quire­ments.

Business email

Stand out with your own branded email

• Build trust with email matching your domain (you@yourbrand.com)
• Free domain included to get your brand online instantly
• Work smarter with AI writing support

See plans

Special cer­tifi­cates for gateways and teams

The cer­tifi­cates described above are generally used to verify a single email address. In busi­ness­es, however, issuing a separate cer­tifi­cate for every in­di­vid­ual address may be im­prac­ti­cal. Al­ter­na­tive ap­proach­es are therefore often used:

• Team cer­tifi­cates for shared or func­tion­al mailboxes such as info@ or support@
• Gateway or domain cer­tifi­cates for centrally managed or automated email sending

Modern solutions are often im­ple­ment­ed through hosted S/MIME, where keys and signing processes are managed centrally. Hosted S/MIME acts as an over­ar­ch­ing system within which different cer­tifi­cates can be used. Com­pat­i­bil­i­ty depends on the email client, but is generally supported by current email programs.

What technical standards are used to digitally sign emails?

Before you can use a digital signature, your email client must be con­fig­ured ac­cord­ing­ly. Once this has been done, the signing and ver­i­fi­ca­tion processes described above take place au­to­mat­i­cal­ly in the back­ground.

Two main standards are available for digitally signing emails: S/MIME and OpenPGP. Both define how email sig­na­tures are created, trans­mit­ted and verified across different email programs. They follow the same basic principle but differ in how iden­ti­ties are verified and keys are managed.

• S/MIME uses X.509 cer­tifi­cates and a central cer­tifi­cate in­fra­struc­ture based on cer­tifi­cate au­thor­i­ties. This generally makes it easier to manage in companies with many users and clearly defined re­spon­si­bil­i­ties. The current S/MIME 4.0 spec­i­fi­ca­tion is set out in RFC 8551.
• OpenPGP uses de­cen­tral­ized key man­age­ment, allowing users to generate and exchange their own keys. Trust is es­tab­lished through direct ver­i­fi­ca­tion rather than through a central authority. The current OpenPGP spec­i­fi­ca­tion is RFC 9580.

Ad­di­tion­al security measures for digital email sig­na­tures

Digital email sig­na­tures protect the integrity and au­then­tic­i­ty of in­di­vid­ual messages. In practice, however, they are in­creas­ing­ly combined with ad­di­tion­al security measures to detect modern threats such as AI-powered phishing and business email com­pro­mise more reliably. Ap­proach­es based on ar­ti­fi­cial in­tel­li­gence, blockchain and bio­met­rics are par­tic­u­lar­ly relevant, as each performs a different function within a broader security framework.

AI-based con­tex­tu­al analysis rather than cryp­tog­ra­phy

Ar­ti­fi­cial in­tel­li­gence has sig­nif­i­cant­ly changed the nature of email-based attacks. Phishing emails can now be gram­mat­i­cal­ly polished, con­tex­tu­al­ly relevant and tailored to in­di­vid­ual re­cip­i­ents. Tra­di­tion­al warning signs, such as poor grammar or unusual wording, are therefore becoming less reliable. To identify threats such as AI-powered phishing, companies in­creas­ing­ly use AI-based tools to assess risks and analyze incoming messages:

• Microsoft Defender for Office 365: machine-learning-based detection of phishing and business email com­pro­mise attacks
• Google Workspace Security: machine-learning models for iden­ti­fy­ing sus­pi­cious patterns in email com­mu­ni­ca­tion
• Proof­point and Mimecast: email security gateways with AI- and machine-learning-based threat detection

These AI-based tools do not them­selves create digital email sig­na­tures. Whether a product checks S/MIME sig­na­tures or uses their val­i­da­tion results in its analysis depends on its doc­u­ment­ed features and con­fig­u­ra­tion; this should not be assumed for every product. Cryp­to­graph­ic signature val­i­da­tion and AI-based con­tex­tu­al analysis perform different tasks, and neither makes a validly signed phishing message au­to­mat­i­cal­ly trust­wor­thy.

Blockchain solutions

Blockchain-based tech­nolo­gies are often discussed as a possible basis for digital identity systems. Concepts such as de­cen­tral­ized iden­ti­fiers (DIDs) and ver­i­fi­able cre­den­tials aim to allow iden­ti­ties to be confirmed without relying on central cer­tifi­cate au­thor­i­ties. In email com­mu­ni­ca­tion, however, these ap­proach­es currently have little practical relevance. Standards such as S/MIME and OpenPGP are not designed for blockchain-based in­fra­struc­tures, and widely supported in­te­gra­tions for common email programs are still lacking.

Blockchain cannot directly replace digital email sig­na­tures. Its potential value instead lies in extending existing identity and trust models. Possible ap­pli­ca­tions include:

• verifying identity in­for­ma­tion outside the digital email signature itself, for example through de­cen­tral­ized iden­ti­fiers or ver­i­fi­able cre­den­tials
• creating tamper-resistant records of identity mappings or cer­tifi­cate events, such as issuance and re­vo­ca­tion
• sup­ple­ment­ing tra­di­tion­al cer­tifi­cates with ad­di­tion­al tamper-resistant metadata

These ap­proach­es remain largely con­cep­tu­al. For email com­mu­ni­ca­tion, S/MIME sig­na­tures continue to rely on PKI-based cer­tifi­cates, while OpenPGP uses its own key-man­age­ment and trust models. Blockchain could, at most, serve as an ad­di­tion­al external layer of trust in future.

Biometric au­then­ti­ca­tion rather than sig­na­tures

Biometric methods such as fin­ger­print or facial recog­ni­tion cannot replace a digital signature, but they can provide an ad­di­tion­al layer of security. Their purpose is to control access to the signing process rather than create the cryp­to­graph­ic signature itself.

• Pro­tect­ing access to the private key: The private key is stored in a secure en­vi­ron­ment, such as a hardware security module or cloud vault. Before the key can be used, the person’s identity may be verified through fin­ger­print or facial recog­ni­tion. The signing process is au­tho­rized only after suc­cess­ful biometric au­then­ti­ca­tion.
• Sup­port­ing identity ver­i­fi­ca­tion before cer­tifi­cate issuance: Biometric methods can also strength­en security before a digital email signature is used. During the cer­tifi­cate ap­pli­ca­tion process, they may support remote identity checks, liveness detection and measures designed to prevent identity fraud.

How to set up and use a digital email signature in Microsoft Outlook

This section explains how to set up and enable a digital email signature in Microsoft Outlook for Windows. The process differs between classic Outlook and the new Outlook, so you should first check which version of Outlook you are using.

Setup in classic Outlook

Step 1: Obtain and install a digital cer­tifi­cate

S/MIME cer­tifi­cates are available from various providers. Some require only mailbox val­i­da­tion, while others include ad­di­tion­al identity checks. Once issued, the cer­tifi­cate is generally provided as a file, such as .p12 or .pfx. Double-click the file to install it in the operating system’s personal cer­tifi­cate store. Outlook can then access the cer­tifi­cate au­to­mat­i­cal­ly.

Step 2: Enable the cer­tifi­cate in Outlook

1. Open Outlook and select “File,” followed by “Options” and “Trust Center.”
2. Select “Trust Center Settings,” then open “Email Security.”
3. Under “Digital IDs (Cer­tifi­cates),” use “Import/Export” if you need to import the cer­tifi­cate file, and enter its password.
4. If necessary, under “Encrypted email,” open “Settings” and select “Choose” next to “Signing Cer­tifi­cate” to select a cer­tifi­cate valid for digital signing.

Step 3: Compose and send a digitally signed email

When writing a new email, you can activate the digital signature manually. In the message window, select “Options,” open the dialog box launcher in “More Options,” select “Security Settings…” and then “Add digital signature to this message.” Outlook creates the digital signature au­to­mat­i­cal­ly when the email is sent. The message remains readable, but any sub­se­quent changes can be detected.

Re­cip­i­ents will see a no­ti­fi­ca­tion in Outlook con­firm­ing that the message has been digitally signed. By selecting the signature icon, they can view further details, including whether the signature is valid, which cer­tifi­cate was used and which cer­tifi­cate authority issued it.

Setup in new Outlook

The new Outlook now supports importing digital IDs and using S/MIME cer­tifi­cates. However, the available options may depend on your Microsoft 365 account and your company’s ad­min­is­tra­tor settings.

Step 1: Obtain and install a digital cer­tifi­cate

S/MIME cer­tifi­cates are available from various providers. Some require only mailbox val­i­da­tion, while others include ad­di­tion­al identity checks. Once issued, the cer­tifi­cate is generally provided as a file, such as .p12 or .pfx.

The new Outlook does not au­to­mat­i­cal­ly import digital cer­tifi­cates. You can instead import the cer­tifi­cate directly through the S/MIME settings.

Step 2: Import and enable the cer­tifi­cate in Outlook

1. In Outlook, select the cogwheel icon in the top-right corner.
2. Go to “Mail” and then “S/MIME.”
3. Under “Digital IDs (Cer­tifi­cates)”, select “Import.”
4. Locate the cer­tifi­cate file and enter its password.
5. Save the settings to complete the import.

You can also choose “Add a digital signature to all messages I send” under “Settings > Mail > S/MIME.” This option may be un­avail­able when the relevant setting is managed by an ad­min­is­tra­tor.

Step 3: Compose and send a digitally signed email

When writing a new email, open “More Options” and select the option to digitally sign the message. Outlook creates the digital signature when the email is sent. The message remains readable, but re­cip­i­ents can detect whether its signed content has sub­se­quent­ly been altered.

Re­cip­i­ents will see an in­di­ca­tion that the message has been digitally signed. By selecting the signature icon, they can view details such as whether the signature is valid, which cer­tifi­cate was used and which cer­tifi­cate authority issued it.