TLS
Transport Layer Security: the protocol that encrypts and authenticates a connection, used in email between servers through STARTTLS and between apps and servers.
What it means
TLS protects data in transit: it encrypts the connection and lets the client authenticate the server by its certificate. The current version is TLS 1.3 (RFC 8446). In email it appears in three places: server-to-server SMTP, usually upgraded with STARTTLS on port 25; message submission from mail apps, on port 465 (TLS from the start) or 587 (STARTTLS); and IMAP or POP access.
Between mail servers, TLS is opportunistic by default: used when both sides offer it, commonly without rejecting invalid certificates, and dropped silently when unavailable. MTA-STS and DANE let a receiving domain demand authenticated TLS.
Google's sender guidelines require TLS from every sender, Gmail can defer or block mail delivered without it, and Workspace domains can refuse unencrypted mail outright.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3rfc-editor.org
- RFC 8314: Cleartext Considered Obsolete: Use of TLS for Email Submission and Accessrfc-editor.org
- RFC 8689: SMTP Require TLS Option, section 1rfc-editor.org
- Google: Email sender guidelinessupport.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes