TLS: opportunistic or enforced

There are two ends to think about: your connection to usend, and usend's connection to the recipient's mail server.

#Your connection to usend: always encrypted

• API: HTTPS only.
• SMTP submission: port 587 (STARTTLS) or 465 (implicit TLS). Encryption is required. usend never offers authentication before the connection is encrypted, and plain connections and port 25 are not offered. See Send with SMTP.

Keep certificate verification on in your client.

#usend to the recipient: opportunistic

Mail between servers uses opportunistic TLS. usend's sending servers offer TLS (version 1.2 or newer) to every receiving server and use it whenever the other side supports it. If the receiving server does not support TLS, the message is delivered unencrypted rather than not at all.

This is how almost all email on the internet works, and nearly every large provider (Gmail, Outlook, Yahoo, iCloud) supports TLS, so most of your mail is encrypted in transit.

#Enforced TLS

Enforced TLS means refusing to deliver when the other side cannot encrypt. It protects against downgrade attacks, but it makes mail to old or misconfigured servers fail. usend's sending policy is set by the operator for the platform's relays; there is no per-email or per-organization option to require TLS in the API. If a regulation requires enforced TLS to certain partners, contact [email protected] before you rely on usend for that traffic.

#What encryption does not cover

TLS protects mail between servers only. Mail is stored unencrypted at the providers, and anyone with access to the mailbox can read it. For sensitive content, do not send the secret itself in an email: send a link to an authenticated page, or use end-to-end encryption such as S/MIME or PGP in your own application (usend carries the encrypted message like any other attachment).

#What usend stores

usend stores the email content for your plan's retention period, then deletes the bodies and attachments. It signs outgoing mail with DKIM, which proves the message was not changed in transit. See Verify a domain.

#Checking an email

In the received message's headers (in Gmail: Show original), a line such as Received: ... with ESMTPS (version=TLS1_3 ...) shows that the last hop was encrypted.