Send email only over an encrypted connection with Enforced TLS

At the end of July we launched the IP allowlist for API tokens, which lets you set the servers your email can be sent from. Today we add the connection to the recipient.

When you send an email, our servers connect to the recipient's mail server. We secure that connection with TLS (Transport Layer Security) as soon as the other side supports it. That is the default setting and it is called Opportunistic.

Whether that encryption happens is up to the receiving server. If that server does not support TLS, the message is still delivered, but without encryption. For a newsletter sent through broadcast email that is rarely a problem. If you send a transactional email with an invoice or patient record data, Enforced is worth considering.

How it works

Sending an email happens in two parts. In part 1 your application sends the email to us, through the API or through SMTP.

Part 2 is the delivery. We look up the recipient's mail server and connect to it. This is the only part that depends on an outside party. How that server is configured and which connections it accepts determines whether the delivery is encrypted. And that is exactly what the new setting is for.

When should you turn this on?

For most of your sending, Opportunistic is the right choice. Delivery always goes through, including to servers that offer no encryption. Enforced is meant for email whose contents should never travel across the internet unencrypted.

This mostly comes up at organisations that work with personal data, such as healthcare or government. A data processing agreement or an internal policy often states that the transport has to be encrypted. With Enforced you can require that on the routes where it matters, while setting other routes such as the one for broadcast email less strictly.

How to set it up

Each route defines what happens by default. Set a route to Enforced and everything going through that route is only delivered with encryption. That way you can run all transactional emails with sensitive contents through a single route and apply the strictest setting there.

You can also handle it for one email. Through SMTP you pass it along with the X-LM-Override-TLS header, and it works the same way through the API and our SDKs. Useful when a route occasionally carries something that needs to be stricter, or less strict.

          curl --request POST \
  --url https://api.lettermint.co/v1/send \
  --header 'x-lettermint-token: your-api-key' \
  --header 'Content-Type: application/json' \
  --data '{
    "from": "no-reply@hgwrts.edu",
    "to": ["harry@owlpost.com"],
    "subject": "Confidential: your grades are in",
    "html": "<p>Your grades are in!</p>",
    "settings": {
      "tls": "enforced"
    }
  }'

        

Now available

You will find the setting in your dashboard (opens in a new window) under a route's settings. Everything is set to Opportunistic by default, so nothing about your sending changes unless you adjust it. You can read more in our documentation on TLS.