Definition
Transport Layer Security (TLS) encrypts the connection between email servers as messages travel across the internet. When TLS is used, the email content cannot be read or modified in transit. Major ISPs including Gmail, Yahoo, and Microsoft now require TLS for all email delivery, and may reject or mark-down mail sent without it.
How It Works
- Your sending server connects to the receiving server and requests a TLS handshake
- The receiving server presents its TLS certificate
- Both sides agree on an encryption method and exchange keys
- The email is encrypted before sending and decrypted upon arrival
Outbound TLS vs Inbound TLS
- Outbound TLS: Your server encrypts mail you send to other providers — configure in your ESP or SMTP settings
- Inbound TLS: Your server requires TLS from senders delivering mail to you — configure in your MX server settings
MTA-STS and TLS Reporting
MTA-STS (SMTP MTA Strict Transport Security) tells receiving servers that you always require TLS for your domain. TLS Reporting (TLS-RPT) provides reports on delivery failures caused by TLS issues. Both are DNS-based policies that supplement basic TLS.
Related Glossary Terms
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Rate Threshold
A bounce rate threshold is the percentage of hard or soft bounces at which email platforms and ISPs begin to penalise sender reputation, typically around 2-5%.
Bounce Rate
Email bounce rate is the percentage of emails that were rejected by the receiving server before reaching the recipient. It is a key indicator of list health and data quality.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.