It will prevent it as long as the client has your CA's public certificate embedded. Browsers/OS embed all of the normal CA's certs so that you know any cert sig

It will prevent it as long as the client has your CA's public certificate embedded. Browsers/OS embed all of the normal CA's certs so that you know any cert signed by a regular CA is authentic. However, regular CAs are not incredibly trustworthy and are a security problem... (Regular CAs can be attacked with fairly easily with social attacks, and some CAs can even be bribed or hacked.) Giving Google your CA or your public mail cert are effectively the same thing in theory, as long as Google only uses your CA cert to authenticate your own servers and not anybody elses. In practice, current CA management software in most OSes is (imho) faulty, and will allow any CA in the chain to authenticate any cert. This probably needs to be fixed at some point... So until then, there is no way Google is going to accept your CA, but they SHOULD change their systems to accept a specific public cert for a mailserver for POP3 fetching.