🔑 Key Takeaways
- Portal, S/MIME, and PGP each open a different way; the wrapper email tells you which.
- Purview messages open in any browser via Microsoft, Google sign-in, or a one-time passcode.
- S/MIME needs a matching certificate in the OS keychain or Outlook's Personal cert store.
- PGP messages decrypt inside Thunderbird, GPG Suite, or Mailvelope, never at the mail server.
- Expired links, wrong account, missing cert, and mobile popup blocks cover most open failures.
Receiving an encrypted email is common for anyone in healthcare, finance, or legal work. The message arrives with a lock icon, a portal link, or a strange attachment, and the recipient needs to know what to do next.
The steps depend on how the sender encrypted the message. This guide covers the main methods in the order recipients see them. For senders shopping the reverse side, encrypted email services cover the outbound options.
Each section below matches one encryption method. Skip to the method that matches the message you received.
Identifying the encryption method from the notification email
The first step is identifying how the sender encrypted the message. The notification email usually gives away the method in the subject line, body, or attachments.
- Subject like “encrypted message” plus a Read the message button in the body means Microsoft Purview Message Encryption.
- Subject like “You have a secure message” plus a portal link means a gateway service like Mailhippo, Zix, or Virtru.
- A .p7m attachment with an unencrypted subject means an S/MIME message.
- A .asc attachment or a message body starting with “BEGIN PGP MESSAGE” means PGP.
- No visible encryption signal but a lock icon in Outlook or Apple Mail means client-side TLS or S/MIME already decrypted.
Once you know the method, follow the section below that matches. The sibling article what is an encrypted email mean covers the underlying concepts if the method is unfamiliar.
Opening a Microsoft Purview encrypted message
Microsoft Purview Message Encryption is the default for Microsoft 365 Business Premium and Enterprise senders. The notification email arrives from the sender’s address with a Read the message button.
Click the button. A browser opens to outlook.office.com or a similar Microsoft portal. Sign in with one of three options.
Sign in with the Microsoft account that received the message. Sign in with a Google account if the receiving address is a Gmail address. Or request a one-time passcode, which arrives at the same email address within a minute.
Once signed in, the message body appears in the browser. A Reply button in the portal lets you send a secure reply through the same encrypted channel.
The Microsoft support guide for opening protected messages covers the same flow with screenshots.
Opening a gateway service portal message
Gateway services like Mailhippo deliver notification emails with a link to a hosted portal. The portal design varies by vendor, but the flow is consistent.
Click the Read the message link. The browser opens to the vendor’s portal. Enter the email address that received the notification if the portal does not auto-fill it.
Request a one-time passcode. The passcode arrives at the receiving address within a minute. Enter the passcode in the portal to unlock the message.
The message body appears in the portal along with any attachments. A Reply button lets you send a secure reply back to the sender through the same channel.
Some gateway services let recipients create a persistent account, which stores past messages and skips the one-time passcode step on future opens. Related coverage in outlook how to open encrypted email covers the Outlook-side variant.
Opening an S/MIME encrypted message in Outlook
S/MIME messages open automatically in Outlook if the matching certificate is installed. If the message arrives as a .p7m attachment or an unreadable body, the certificate is missing.
- Obtain your S/MIME certificate from your organization’s certificate authority or a commercial CA.
- Import the certificate into the Windows certificate store under Personal, Certificates.
- Restart Outlook so it detects the certificate.
- Open the message. It should now decrypt automatically, and a small ribbon icon appears in the header.
- Click the ribbon icon to view the certificate details of the encryption.
If the message still shows as a .p7m attachment, either the certificate has expired, or the sender used a different certificate than the one they have on file for you. Ask the sender to verify your current public certificate.
Sibling coverage in how to open an encrypted email covers the same S/MIME flow with more troubleshooting.
Opening an S/MIME encrypted message in Gmail
Gmail supports S/MIME only on Google Workspace Enterprise Plus with hosted S/MIME enabled. Personal @gmail.com accounts cannot open S/MIME messages natively.
On a Workspace Enterprise Plus account, upload your S/MIME certificate under Gmail settings, Accounts and Import, S/MIME settings. Gmail then decrypts incoming S/MIME messages automatically.
A green lock icon appears next to the sender’s name when the message decrypted successfully. Clicking the icon shows the certificate that signed the message.
Personal Gmail users who receive S/MIME messages need to open them elsewhere, such as through Thunderbird or Apple Mail with the same certificate installed. Or ask the sender to use a portal-based method that does not depend on the recipient’s setup.
The Google support article on S/MIME messages covers the certificate management flow in more depth.
Opening a PGP encrypted message
PGP messages are less common but still appear in journalism, activism, and technical workflows. Opening them requires a PGP-capable client and the recipient’s private key.
Thunderbird has built-in PGP support since version 78. Import your private key under Account Settings, End-to-End Encryption. The client decrypts incoming PGP messages automatically.
Apple Mail on macOS supports PGP through the GPG Suite add-on. Install the suite, import your private key, and Apple Mail decrypts PGP messages when you open them.
Web clients like Gmail need a browser extension such as Mailvelope. The extension prompts for the private key passphrase when a PGP message opens in the browser.
If the client cannot decrypt the message, the private key is not installed or does not match the public key the sender used. Send your current public key to the sender and ask them to resend.
Opening encrypted email on iPhone and Android
Mobile devices handle encrypted email differently depending on the encryption method and the mail app.
Portal-based messages open in the browser through the notification email link. Safari on iPhone and Chrome on Android both handle the sign-in flow the same way as a desktop browser.
The Outlook app for iOS and Android handles Microsoft Purview messages natively if the recipient signs in with the same Microsoft account. The message opens in the app without a browser redirect.
S/MIME messages require the certificate installed in the device’s system keychain. On iOS, go to Settings, General, VPN and Device Management, and install the profile containing the certificate. On Android, use Settings, Security, Install from storage.
PGP on mobile requires a dedicated mail client with PGP support, such as OpenKeychain plus K-9 Mail on Android or PGP Everywhere on iOS. The Gmail and Outlook apps do not support PGP directly.
Sibling coverage in how to open encrypted email on iPhone walks through the iOS variant in more detail.
Troubleshooting expired or broken portal links
The most common failure is a portal link that no longer works. Encryption services usually set an expiration window that the sender configures.
If the portal says the link expired, ask the sender to resend the message. Most services let the sender reset the expiration without composing a new message.
If the portal loads but the sign-in fails, verify you are using the exact email address that received the notification. Address variants like alias forwarders or plus-suffixed addresses often break the match.
If the one-time passcode does not arrive, check the spam folder and confirm the notification email address matches the address you entered on the portal. Some services block the passcode if a different address is entered.
Sibling coverage in how to troubleshoot encrypted email covers additional error patterns.
Replying to an encrypted email safely
A reply is only as encrypted as the channel it travels through. Replying from your regular inbox does not preserve the encryption automatically.
Portal-based services offer a Reply button inside the portal. The reply travels back through the same encrypted channel, and the sender reads it in their normal inbox with the encryption intact.
S/MIME clients decrypt and re-encrypt automatically when you use Reply, provided your certificate is installed. The lock icon in the reply compose window confirms the encryption will hold.
PGP clients work the same way. The client encrypts the reply with the original sender’s public key, which it already has on file from the incoming message.
If none of those confirmations appear, the reply will travel as ordinary email. Sensitive information should not be included in that case. Sibling coverage in how to send encrypted email covers the outbound side in depth.
What to do when the sender used the wrong method
Sometimes an encrypted message arrives in a form the recipient cannot open. The sender chose a method the recipient’s environment does not support.
Ask the sender to switch to a portal-based service. Portal encryption works regardless of the recipient’s mail client, certificate setup, or device. It is the most reliable fallback for any inbound encrypted message.
If the sender is a healthcare provider, financial institution, or law firm, they usually have a portal-based service available even if they defaulted to S/MIME first. Calling their office is often faster than resolving the technical mismatch by email.
Practices setting up patient communication should test the recipient experience end to end before rolling out. The healthcare website security features checklist covers adjacent considerations for the same audience.
When the encrypted email is part of a larger workflow
An individual encrypted message rarely stands alone. It is usually part of a larger exchange between a patient and a provider, a client and an attorney, or an insurer and an enrollee.
The recipient side of the workflow matters as much as the sender side. A portal-based message that arrives once is easy. A recurring exchange with the same sender benefits from a persistent portal account or a routing rule.
Persistent portal accounts let recipients skip the one-time passcode step and see message history. Routing rules on the recipient’s mail server can flag encrypted notifications and surface them separately in the inbox.
Practices reviewing the broader patient communication footprint can align email decisions with a healthcare marketing agency engagement so the same standards apply across outreach, forms, and encrypted messaging.
For senders considering a full compliant email service that includes automatic recipient-side handling, the Mailhippo secure email service covers the full sender-and-recipient loop.
