It typically works like this:

• Email gets automatically forwarded from me@mydomain.com to your Gmail account.
• When you reply to emails sent me@mydomain.com you are using me@mydomain.com instead of your Gmail address.
• When you send a new email in Gmail, you have the options to choose which email address to use as the sender.

To set it up, you basically go to the Gmail Accounts setting page, click Add another email address in the Send mail as section, and follow the instruction on the screen.

If you are adding a Microsoft 365 email account as another sender in Gmail, there are two main hurdles to overcome.

Microsoft 365 email auto-forward

The email auto-forwarding to an external email address used to be working out of the box, whether it’s set in the Outlook app level or the mail account level. But things have changed lately.

Now, external forwarding is disabled by default in Office 365. While usually it’s a good practice in general, it doesn’t help in this case. However, Microsoft still leaves a door open so you can change that if you need to, given that you understand the danger of it.

So, to re-enable external forwarding, go to the Anti-spam policy page on Microsoft 365 security page, and turn on Automatica forwarding under Outbound spam filter policy.

Enable SMTP Client Authentication

Again, Microsoft doesn’t mess around. The SMTP Authentication is disabled by default in Microsoft 365.

To disable, we need the help from PowerShell.

First, install ExchangePowerShell module if you haven’t done so.

Install-Module ExchangePowerShell

Then, connect to Exchange Online using

Connect-ExchangeOnline

And then, to enable SMTP client authentication, you need to enable it at organization level,

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

as well as at the mailbox level,

Set-CASMailbox <MailboxIdentity> -SmtpClientAuthenticationDisabled $false

Once these two hurdles are solved, you can then move on to finish setting it up.

Not anymore with the use of TLS, StartTLS, or even better S/MIME which is suitable for your most sensitive information.

Every email sent through TLS is encrypted to protect the message in transit from one server to another. It requires both mail servers to follow along in order for the encryption to work. But not all mail servers are equally made. If an email is sent via TLS but the other end doesn’t accept TLS, the email will be degraded from TLS. Like back to the old days, email gets decrypted and delivered in plain text. Bad news for you but good news for the man in the middle.

According to Google, during a 3-month period between March 11, 2019, and June 9, 2019, 89% of emails going out from Gmail and 94% of email received by Gmail are encrypted. And who are the top bad guys?

So how to tell if my incoming emails are encrypted

Gmail

Google is on top of a lot of things. This is no different. If you are using Gmail as your main mail app, you can easily tell whether the email you received has never been intercepted by the man in the middle.

When you get an email, click the little down arrow to reveal the header and you will find if the message was received through TLS or other encryption method.

Outlook

Not as easy as Gmail but still can be done. Open the email you received from outside, click File > Properties.

And look through the Internet headers section. If you see the word TLS in there somewhere you can safely tell your email is safe during the transition.

How to tell if email I am sending is encrypted

For Gmail, if you have S/MIME enabled on your account, you will see a lock icon that shows the level of encryption supported by your message’s recipients. Otherwise, there is no direct way to tell whether your email will be safe all the way to the other end.

But there are a few workarounds that we can still take.

First, we can start with an introduction email and only start sending confidential content after receiving one email from other party and verified that it’s safe.

Or, we can use a TLS checker to scan and verify that the mail server used by the domain you are communicating with supports at least TLS. It’s safe to email me confidential stuff because it’s OK in the TLS column like below.

But never send confidential emails to the mail server that’s not safe like below.

Last, if you are using Gmail and need the highest security for sending confidential via email, you can turn on the Confidential Mode so entire email communication will be secured.

I can’t believe I’ve been using Gmail for almost 15 years. It’s been a long ride and a happy one in overall. I never had to worry about the storage, nor missing emails. With the strong search feature, I can always find what I was looking for in a split second. It helped me write a better subject line so I can find them easier years later. It also keeps my inbox clean with the world-best spam killer and has a way for me to report suspected spam when I saw one. Oh, how can I forget the joy of playing those Gmail Labs? With the new AI-powered features such as Smart Reply and Nudges, I can reply emails a lot quicker with less typing.

So, what’s next:

First off, we’re making Gmail more assistive. You may have already used Smart Compose, an AI-powered feature that helps you write emails quicker.

Next up, you can decide when your email gets delivered to someone else’s inbox. Today, we added a new feature that lets you schedule email to be sent at a more appropriate date or time, which is helpful if you’re working across time zones, or want to avoid interrupting someone’s vacation.

Lastly, you can now take action without leaving your inbox. You can respond to a comment thread in Google Docs, browse hotel recommendations and more, directly within emails. 

The best line:

We may have launched Gmail on April Fools’ Day, but the last 15 years have been no joke. And we’re looking forward to what’s to come.

https://www.blog.google/products/gmail/hitting-send-on-the-next-15-years-of-gmail/

If someone accidentally adds dots to your address when emailing you, you’ll still get that email. For example, if your email is johnsmith@gmail.com, you own all dotted versions of your address:

• john.smith@gmail.com
• jo.hn.sm.ith@gmail.com
• j.o.h.n.s.m.i.t.h@gmail.com

The intention of this is good but it also opens a door for a phishing scam. Here is an example.

James Hfisher received an email from Netflix asking him to update his payment details.

Since the email is genuinely from Netflix, he clicked the link. It logged him in and directed him to an “Update your credit or debit card” page, which again is genuinely hosted on Netflix. No phishing spotted so far.

But then, he found that he doesn’t recognize the credit card number shown on the Update page, never seen that number and certainly never used one. What’s going on?

James finally realized that the email was sent to james.hfisher@gmail.com with a dot in it while the one he uses doesn’t. The email was supposed to be bounced but instead, it ended up in James’ inbox, thanks to Gmail’s dots don’t matter feature.

Here is how this runs down, concluded by James eventually.

1. Hammer the Netflix signup form until you find angmail.com address which is “already registered”. Let’s say you find the victim,jameshfisher
2. Create a Netflix account with address,james.hfisher.
3. Sign up for a free trial with a throwaway card number.
4. After Netflix applies the “active card check”, cancel the card.
5. Wait for Netflix to bill the canceled card. Then Netflix emailsjames.hfisher for a valid card.
6. Hope Jim reads the email to james.hfisher, assumes it’s for his Netflix account backed by jameshfisher, then enters his card,**** 1234.
7. Change the email for the Netflix account to eve@gmail.com, kicking Jim’s access to this account.
8. Use Netflix free forever with Jim’s card **** 1234!

So, dots do matter in some cases.

/via James Hfisher/