Can Someone On The Same WiFi Read Your Emails?

Last blog I talked about open WiFi and what other people on the same network can see. But one question kept coming up that deserved its own post — what about emails specifically?

Emails are interesting because unlike browsing they carry some of the most sensitive information we send every day. Contracts, passwords, personal details, internal business conversations. So let’s dig into what’s actually protected and what isn’t.

How Email Actually Travels

Most people imagine an email going directly from sender to receiver like a phone call. It doesn’t. It hops through multiple servers — your mail server, potentially several relay servers, then the recipient’s mail server — before it arrives.

Each hop is a potential interception point. And historically email was designed with almost no security in mind. It was built for a time when the internet was a small trusted academic network. Those days are long gone.

Can Someone On The Same Network Read Your Emails?

It depends entirely on your setup.

If your email uses TLS encryption — which most modern providers like Gmail and Outlook do — the content of your emails is encrypted in transit. Someone on the same open WiFi can see that you’re communicating with a mail server but not what’s inside those emails.

If your email is configured over an old unencrypted protocol — which still happens more than you’d think, especially in older corporate setups — every word is readable to anyone on that network with a basic packet sniffer. Like sending a postcard instead of a sealed letter.

So the honest answer is — probably not if you’re using a modern provider, but not guaranteed.

Can Someone Send Emails Pretending To Be You?

Yes. This is called email spoofing and it’s easier than most people realise.

On an open network with weak mail server configuration anyone can craft an email that appears to come from your organisation. Your name, your domain, your branding — all fake.

This isn’t just a WiFi problem though. It’s a mail server configuration problem. Three standards exist specifically to fight this:

SPF — specifies which servers are allowed to send email on behalf of your domain. Like a whitelist.

DKIM — adds a digital signature to your emails so the recipient can verify they actually came from you.

DMARC — ties SPF and DKIM together and tells receiving mail servers what to do if something fails — reject it, quarantine it or just report it.

Without these three configured on your mail server spoofing your domain is trivially easy. With them properly set up it becomes much harder.

What About PGP?

PGP is end to end email encryption. The idea is simple — your email is encrypted on your device using the recipient’s public key. Only their private key can decrypt it. Even if someone intercepts the email mid-journey the content is completely unreadable.

This directly solves the email content problem. Even on a completely open hostile network a PGP encrypted email is safe.

But PGP has real practical limitations. Both sender and receiver need to have it set up. Key management is complicated. Most normal users won’t bother. And it doesn’t protect email metadata — the sender, recipient, subject line and timestamp remain visible even with PGP. Someone watching the network still knows you emailed your lawyer even if they can’t read what you said.

And crucially — PGP does nothing for email spoofing. It proves content integrity but doesn’t stop someone sending a fake email pretending to be you. That’s still SPF, DKIM and DMARC territory.

The Honest Summary

Modern email is much safer than it used to be — TLS in transit, HTTPS for webmail, major providers doing a lot of the heavy lifting. But gaps remain.

Spoofing is still a real and underappreciated risk. Metadata always leaks. Legacy email configurations still exist in the wild. And end to end encryption with PGP, while powerful, requires effort most organisations never make.

The takeaway from this week’s lectures — email security is layered. No single solution fixes everything. TLS protects transit. PGP protects content. SPF, DKIM and DMARC protect identity. You need all of them together to be genuinely secure.

Follow along for more 👊