---
sourceDocument: Xanadu ServiceNow AI Platform Administration
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/platform-administration

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu ServiceNow AI Platform Administration

ft:clusterId :

    - platadm

bundleId :

    - platadm

workflow :

    - Platform


---

# Setting up S/MIME for email

# Setting up S/MIME for email {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

S/MIME is a protocol for sending digitally signed and encrypted emails to ensure the
confidentiality, authenticity and integrity.

## Set up S/MIME for outbound mails (signing and encryption) {#smime-for-email-signing-and-encryption__section_h3v_zhg_vtb}

You can use S/MIME for outbound mails for the following purposes:

* Digital signature
* Encryption
* Digital signature and encryption
{#smime-for-email-signing-and-encryption__ul_rxk_qdf_vtb}  
To set up S/MIME, the admin must have the following:

* email_account_admin and sn_kmf.cryptographic_manager roles
* Key pair (private key and public key)
* CA certificate
* Email certificate
{#smime-for-email-signing-and-encryption__ul_wzb_3kg_vtb}

Upload the instance email account key pair and email certificates, and enable outbound
S/MIME properties. For more information, see [Enable S/MIME](https://servicenow-prod.fluidtopics.net/~ChDCEcGR8GXjiXi_cbycw "Configure S/MIME settings for inbound and outbound email.").

If there are multiple recipients and some of the recipients do not have valid certificates,
the email will be sent only to recipients with a valid certificate.

## Set up S/MIME for inbound mails (sign verification and decryption) {#smime-for-email-signing-and-encryption__section_mrm_bmg_vtb}

S/MIME for inbound mails can be used for the following:

* Signature verification
* Decryption
* Signature verification and decryption
{#smime-for-email-signing-and-encryption__ul_lq1_gmg_vtb}

For information about enabling inbound S/MIME properties, see [Enable S/MIME](https://servicenow-prod.fluidtopics.net/~ChDCEcGR8GXjiXi_cbycw "Configure S/MIME settings for inbound and outbound email.").

If the system fails to decrypt a message, no inbound actions will run on the email and it
is moved to the received-ignored status.

To set up the system to ignore inbound signed emails if the signature cannot be verified or
is invalid, admins can create the
email.inbound.smime.ignore_unverified_emails and set it to true.

For more information about key management and cryprographic module, see [Key Management Framework Reference](https://www.servicenow.com/docs/access?context=understanding-kmf&version=xanadu&pubname=xanadu-platform-security&ft:locale=en-US).
* **[Import an S/MIME key pair](https://servicenow-prod.fluidtopics.net/h5Q9PoeYzpZAE07g5NW4lw)**   
  Import an S/MIME key pair consisting of the private key and certificate to sign outbound emails or decrypt emails.
* **[Upload a CA certificate](https://servicenow-prod.fluidtopics.net/75AJrZjHxbp22vrHO62mfw)**   
  Upload a digital CA (Certificate Authority) certificate to validate email certificates for secure communication.
* **[Upload an email certificate](https://servicenow-prod.fluidtopics.net/MCL7DX~DQ3zdQCq9mqVnWQ)**   
  Upload an email certificate to validate a signature for inbound email or encrypt an outbound email or both for secure communication.
* **[Enable S/MIME](https://servicenow-prod.fluidtopics.net/~ChDCEcGR8GXjiXi_cbycw)**   
  Configure S/MIME settings for inbound and outbound email.

**Related tasks**   

* [Activate S/MIME Email](https://servicenow-prod.fluidtopics.net/5oisKs8qBDML5CFN9yYtWQ "You can activate the S/MIME Email plugin (com.glide.email.smime) for Notifications if you have the admin role.")