Skip to main content

​
Transport Layer Security (TLS)

Mailofly uses opportunistic TLS (v1.2 and v1.3) by default for all outbound and inbound email delivery.

​
How TLS Works in Email

When Mailofly delivers an email to a receiving mail server:
  1. STARTTLS Handshake: Mailofly issues the STARTTLS command during the SMTP session.
  2. Encrypted Channel: If the receiving server supports TLS, an encrypted channel is negotiated, protecting the email content and headers from interception or tampering in transit.
  3. Opportunistic Fallback: If the destination mail server does not support TLS, the email is delivered over standard plaintext SMTP to ensure non-disruptive delivery.

​
Enforced TLS

For compliance requirements (HIPAA, SOC 2, financial transactions), Mailofly can enforce strict TLS: messages will only be delivered if the recipient server verifies a valid, authenticated TLS session. If the recipient cannot support TLS, delivery will fail with a descriptive bounce event.

Related topics

Introduction