---
sourceDocument: Xanadu ServiceNow AI Platform Administration
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/platform-administration

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu ServiceNow AI Platform Administration

ft:clusterId :

    - platadm

bundleId :

    - platadm

workflow :

    - Platform


---

# Email encryption - S/MIME protocol

# Email encryption - S/MIME protocol {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Secure/Multipurpose Internet Mail Extensions (S/MIME) is an end-end encryption protocol
for sending digitally signed and encrypted emails that support data confidentiality, authenticity,
and integrity.

## Introduction to S/MIME {#smime-inbound-outbound-mails__section_xy5_xff_vtb}

An administrator with privileges can enable and configure S/MIME. Understanding of the following is required when using the full capabilities of S/MIME:

* Digital signatures and signature verification
* Message encryption and decryption
* Public key
* Digital certificates
{#smime-inbound-outbound-mails__ul_a33_fff_vtb}

## Digital signatures and verification {#smime-inbound-outbound-mails__section_zsj_jhf_vtb}

With digital signature, S/MIME verifies the identity of the sender of the email. This verification ensures the following:

* Message in the email is the exact message sent by the sender.
* Message is received from the right sender and not someone pretending to be the sender.
{#smime-inbound-outbound-mails__ul_q4p_rhf_vtb}

## Message encryption and decryption {#smime-inbound-outbound-mails__section_flk_khf_vtb}

S/MIME uses encryption to protect the content of the email, which ensures that only the
receiver can decrypt the content. Encryption creates coded information so that it cannot be read
or understood until it is decoded and readable. Message encryption helps with the two key
security factors of confidentiality and data integrity.

## Public key {#smime-inbound-outbound-mails__section_odw_hhp_ttb}

S/MIME uses key pairs and asymmetric cryptography. A private key in a key pair belongs only to
the sender. If the private key has been used, the owner of that key has used it.

Public key cryptography ensures secure communication between the sender and the receiver. Both
have a key-pair, with one being private and the other public​.

Public keys are shared between the sender and the receiver. A public key is paired to only one
private key. The corresponding public key is used to identify its paired private key and only
its paired private key. A public key can be used by multiple recipients.  
A key pair can be used to

* Sign and verify a signature
* Encrypt and decrypt the content of an email
{#smime-inbound-outbound-mails__ul_e33_lqf_vtb}

S/MIME digital signatures and encryption require each sender and recipient to have it enabled.
They also need to send or exchange public keys though digital certificates to identify each
other.

For more information about key management and cryprographic module, see [Key Management Framework Reference](https://www.servicenow.com/docs/access?context=understanding-kmf&version=xanadu&pubname=xanadu-platform-security&ft:locale=en-US).

## Digital certificates {#smime-inbound-outbound-mails__section_zzp_krf_vtb}

Digital certificates help in delivering the public key in the key pair. A digital certificate is a digital credential that provides information about the identity, validity, and any other required information. Digital certificates are issued by a certification authority (CA) and are valid for only a specific period of time.  
Note:  
ServiceNow® does not provide S/MIME certificates for ServiceNow mail infra users. Users should get their S/MIME certificates issued from the third party S/MIME certificate solution providers.

## S/MIME outbound emails {#smime-inbound-outbound-mails__section_txr_vhg_vtb}

Signing outbound mails

The ServiceNow AI Platform uses the private key of the sender (instance email account)​ and
the receiver uses the public key to verify signatures.

Encrypting outbound mails

The ServiceNow AI Platform uses public keys of the recipients to encrypt the emails and every
recipient uses their private key to decrypt the email.

## S/MIME for inbound email {#smime-inbound-outbound-mails__section_xsh_nhp_ttb}

Sign verification for inbound mails

The sender uses a private key to sign the email and the ServiceNow AI Platform uses the
public key of the sender to verify the signature.

Decrypting inbound mails

The sender uses the public key to encrypt the email and the ServiceNow AI Platform uses the
private key to decrypt the email.
* **[Activate S/MIME Email](https://www.servicenow.com/docs/5oisKs8qBDML5CFN9yYtWQ)**   
  You can activate the S/MIME Email plugin (com.glide.email.smime) for Notifications if you have the admin role.
* **[Setting up S/MIME for email](https://www.servicenow.com/docs/YYA4Fl~gGRix_yV8M44UOA)**   
  S/MIME is a protocol for sending digitally signed and encrypted emails to ensure the confidentiality, authenticity and integrity.