---
title: "Send email only over an encrypted connection with Enforced TLS"
description: "We already encrypt the connection to the receiving server whenever we can. With Enforced TLS you decide what happens when that fails, per route or per message."
url: "https://lettermint.co/changelog/send-email-only-over-an-encrypted-connection-with-enforced-tls"
published: "2026-08-06"
last_updated: "2026-08-06"
---

# Send email only over an encrypted connection with Enforced TLS

> We already encrypt the connection to the receiving server whenever we can. With Enforced TLS you decide what happens when that fails, per route or per message.

At the end of July we launched the
[IP allowlist for API tokens](https://lettermint.co/changelog/restrict-your-api-tokens-to-specific-ip-addresses),
which lets you set the servers your email can be sent
from. Today we add the connection to the recipient.

When you send an email, our servers connect to the
recipient's mail server. We secure that connection with
TLS (*Transport Layer Security*) as soon as the other
side supports it. That is the default setting and it is
called **Opportunistic**.

Whether that encryption happens is up to the receiving
server. If that server does not support TLS, the message
is still delivered, but without encryption. For a
newsletter sent through
[broadcast email](https://lettermint.co/features/broadcast-emails)
that is rarely a problem. If you send a
[transactional email](https://lettermint.co/features/transactional-emails)
with an invoice or patient record data, **Enforced** is
worth considering.

![Lettermint TLS settings](https://lettermint.co/content/changelog/lettermint-tls-settings.webp)

## How it works

Sending an email happens in two parts. In part 1 your
application sends the email to us, through the
[API](https://lettermint.co/docs/api-reference/introduction)
or through
[SMTP](https://lettermint.co/knowledge-base/definitions/what-is-smtp).

Part 2 is the delivery. We look up the recipient's mail
server and connect to it. This is the only part that
depends on an outside party. How that server is
configured and which connections it accepts determines
whether the delivery is encrypted. And that is exactly
what the new setting is for.

### When should you turn this on?

For most of your sending, **Opportunistic** is the right
choice. Delivery always goes through, including to
servers that offer no encryption. **Enforced** is meant
for email whose contents should never travel across the
internet unencrypted.

This mostly comes up at organisations that work with
personal data, such as healthcare or government. A data
processing agreement or an internal policy often states
that the transport has to be encrypted. With **Enforced**
you can require that on the routes where it matters,
while setting other routes such as the one for broadcast
email less strictly.

## How to set it up

Each *route* defines what happens by default. Set a route
to **Enforced** and everything going through that route
is only delivered with encryption. That way you can run
all transactional emails with sensitive contents through
a single route and apply the strictest setting there.

You can also handle it for one email. Through SMTP you
pass it along with the `X-LM-Override-TLS` header, and it
works the same way through the API and our SDKs. Useful
when a route occasionally carries something that needs to
be stricter, or less strict.

```bash
curl --request POST \
  --url https://api.lettermint.co/v1/send \
  --header 'x-lettermint-token: your-api-key' \
  --header 'Content-Type: application/json' \
  --data '{
    "from": "no-reply@hgwrts.edu",
    "to": ["harry@owlpost.com"],
    "subject": "Confidential: your grades are in",
    "html": "<p>Your grades are in!</p>",
    "settings": {
      "tls": "enforced"
    }
  }'
```

## Now available

You will find the setting in your
[dashboard](https://app.lettermint.co)
under a route's settings. Everything is set to
**Opportunistic** by default, so nothing about your
sending changes unless you adjust it. You can read more
in our documentation on
[TLS](https://lettermint.co/docs/platform/emails/tls).