Will quantum computing break current encryption?

Here's a question that sounds like science fiction but sits on every serious security team's radar: will quantum computers eventually crack the encryption protecting your email? The short answer is yes, probably, but not anytime soon. The more useful answer is that there are things worth doing today, even if the threat is still years away.

Today's email encryption relies on asymmetric algorithms like RSA and ECC. The security of those algorithms depends on math problems that classical computers can't solve in any reasonable timeframe. A sufficiently powerful quantum computer could solve those same problems quickly, which would put DKIM signatures, TLS connections, S/MIME, and PGP at real risk.

"Sufficiently powerful" is doing a lot of heavy lifting in that sentence. Estimates from security researchers range from 10 to 30 years for a cryptographically relevant quantum computer to exist. That's a wide window, and the honest truth is nobody knows exactly where on that timeline we are.

But here's the thing that makes this more urgent than the timeline suggests: harvest now, decrypt later attacks. Nation-state actors and sophisticated threat groups are already collecting encrypted data today, betting they'll be able to decrypt it once quantum capability arrives. If your email traffic carries anything sensitive, assume some of it is already being archived by someone with patience.

So what should you actually do today?

• Plan for crypto agility. This means building your systems so you can swap out cryptographic algorithms without a full infrastructure rebuild. If your email stack assumes RSA forever, that's a fragility worth addressing now.
• Watch the NIST post-quantum standards. NIST finalized its first post-quantum cryptography standards in 2024. Your vendors will start adopting these. Know what they are so you can ask the right questions.
• Audit your key rotation practices. If you're using DKIM keys you haven't rotated in years, that's a problem independent of quantum computing. Good key hygiene now builds the muscle you'll need later.
• Talk to your ESP and hosting providers. Post-quantum TLS is already in early deployment at some providers. Ask where yours stands on the roadmap.

For most email operators running marketing or transactional programs, quantum computing isn't a fire to fight today. It's a slow-moving weather system you want to track so you're not caught unprepared when it arrives. The organizations that will struggle most are the ones who never build crypto agility into their stack and then have to retrofit everything under pressure.

If you're working through a broader authentication review and want a second set of eyes on your current setup, our SOS hotline is free and we're happy to talk through where post-quantum planning fits in your priorities.