> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailofly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# TLS

> Understanding opportunistic and enforced TLS encryption for in-transit email delivery.

# Transport Layer Security (TLS)

Mailofly uses opportunistic TLS (v1.2 and v1.3) by default for all outbound and inbound email delivery.

## How TLS Works in Email

When Mailofly delivers an email to a receiving mail server:

1. **STARTTLS Handshake**: Mailofly issues the `STARTTLS` command during the SMTP session.
2. **Encrypted Channel**: If the receiving server supports TLS, an encrypted channel is negotiated, protecting the email content and headers from interception or tampering in transit.
3. **Opportunistic Fallback**: If the destination mail server does not support TLS, the email is delivered over standard plaintext SMTP to ensure non-disruptive delivery.

## Enforced TLS

For compliance requirements (HIPAA, SOC 2, financial transactions), Mailofly can enforce strict TLS: messages will only be delivered if the recipient server verifies a valid, authenticated TLS session. If the recipient cannot support TLS, delivery will fail with a descriptive bounce event.


## Related topics

- [Introduction](/smtp/introduction.md)