Are outgoing emails encrypted

Opportunistic TLS 1.2 or higher, on by default. It cannot be forced, and that distinction is what a security questionnaire is asking about.

In transit, usually. Zendesk Support and Chat have opportunistic support for TLS 1.2 or higher, on by default for every account. The word opportunistic is doing the work: it cannot be forced, and that distinction is what a security questionnaire is asking about.

Does that mean every email we send is encrypted?

TLS is used when the receiving server also supports it. When it does not, ESMTP is used instead, and the message goes unencrypted.

So the honest answer is "encrypted whenever the other side supports it, and Zendesk cannot require that". If somebody needs to state that outbound mail is always encrypted, opportunistic TLS does not give them that, and answering otherwise on a questionnaire is a problem you find out about later.

Where enforced encryption is genuinely required, relaying outbound mail through your own infrastructure is the route: the Exchange, Gmail and authenticated SMTP connectors all send over TLS. Ask us before choosing between them, because they differ in what else changes.

What people sometimes mean instead

Encrypting the message itself, so only the recipient can read it. That is a different mechanism, and the consequence for support is real: Zendesk cannot read an encrypted body, so it cannot thread it, search it, or act on it with rules.

Organisations with that requirement usually keep those conversations outside the ticketing system rather than trying to have both.

See also

• Email encryption and private relay services
• Which Zendesk products fall under which compliance programme