IT security

Transport Layer Security (TLS)

Updated October 16, 2026

Transport Layer Security (TLS) protects a network connection against eavesdropping and certain forms of tampering. In email, it can protect connections between clients and servers or between mail servers. It secures transport between those endpoints; it does not by itself provide end-to-end protection of every stored or forwarded copy of a message.

2 min. read

What do I need to know about Transport Layer Security (TLS)?

Opportunistic and enforced transport protection have different failure behavior. Confirm which model applies to an important route.
TLS certificates and domain checks matter when validating the server at the other end of a connection.
MTA-STS is a mechanism through which a receiving domain can publish a transport-security policy for supporting senders.
Transport encryption does not approve a sender’s identity claim or establish that message content is benign.

An illustrative example

A company needs protected delivery to a business partner. It verifies the supported connector and transport policy on both sides and tests failure behavior. Seeing one successful encrypted delivery is useful, but it does not prove that future failures cannot fall back to a different path under the configured policy.

Practical checks

Document which client and server connections require encryption and which systems own those policies.
Test representative delivery and failure cases using supported provider tools.
Use message-level protection when confidentiality requirements extend beyond transport between servers.

Five FAQs about Transport Layer Security (TLS)

Is TLS the same as end-to-end email encryption?

No. TLS protects a connection between systems. End-to-end message protection aims to restrict reading of the message itself to authorized endpoints under a separate key and access model.

Does HTTPS on a phishing page mean it is legitimate?

No. HTTPS uses TLS to protect the connection to that page. The domain can still belong to an attacker.

Can TLS prevent email spoofing?

Not by itself. Transport security and message-domain authentication address different questions. SPF, DKIM, and DMARC remain relevant.

What does MTA-STS add?

It lets a receiving domain publish a policy describing supported mail hosts and transport requirements for senders that implement it. Deployment needs correct DNS, HTTPS policy hosting, and operational monitoring.

Can enforcing TLS affect delivery?

Yes. If the required secure connection cannot be established, delivery may fail or be deferred according to the system’s policy. Test important partners and define how exceptions are handled.