SMTP authentication is broken. Don&#x27;t rely on it for confidentiality. There is no cert-pinning RFC for STARTTLS afaik, so stripping attacks on STARTTLS are still possible. And, by far the most important: most of the world uses a large E-mail provider. So, if you send a mail to someone using Gmail&#x2F;Yahoo Mail&#x2F;Outlook, your &quot;confidential&quot; data is leaked. And don&#x27;t forget metadata leakage. Metadata is <i>by far</i> more interesting for the NSA than then the content of your mails.<p>I use Gmail + GPG (almost nobody uses GPG) in Thunderbird. When I truly need confidentiality over internet communication, I use Signal.<p>SMTP is just plain broken in a sense of security.