Email as we use it today makes no guarantees about message integrity, authenticity, or confidentiality. Users must explicitly encrypt and sign message contents using tools like PGP if they wish to protect themselves against message tampering, forgery, or eavesdropping. However, few do, leaving the vast majority of users left open to such attacks. Fortunately, some degree of protection against network-based eavesdropping attacks is provided by transport-layer security, an option supported by all major mail transfer protocols (SMTP, IMAP, and POP3), and against tampering and forgery by DKIM and SPF. In this thesis we evaluate the security provided by these protocols, both in theory and in practice. Using a combination set of measurement techniques, we determine whether each provider supports TLS at each point in their email message path, and whether the provider support SPF and DKIM on incoming and outgoing mail. We found that while more than half of the top 20,000 receiving MTAs supported TLS, and support for TLS is increasing, servers do not check certificates, opening the Internet email system up to man-in-the-middle eavesdropping attacks. Use of SPF is common, however enforcement is limited. Few of the senders we examined used DKIM, and fewer still rejected invalid DKIM signatures. Today's global email system thus provides some protection against passive eavesdropping, limited protection against unprivileged peer message forgery, and no protection against active network-based attacks. We observe that protection even against the latter is possible using existing protocols with proper enforcement