Fastmail's explainer walks through the layers of email encryption, from TLS in transit and full-disk encryption at rest to DANE, MTA-STS and zero-access designs. It argues DNSSEC deployment risk, illustrated by Cloudflare and .nz outages, outweighs DANE's confidentiality gains for now.