---
schema_version: "1"
id: dd8230f8d3c64a7d1362fb0ba1db7d2184fad92e1c22648b022a6a51ccde8b0d
title: Set Up Transaction Layer Security (TLS)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/emailadmin_set_up_tls.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_set_up_tls.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: bf18d5b327245f6746c1134959376edd8932a1dd7132d388243ebe2116317287
description: Transaction Layer Security (TLS) encrypts the contents of an email transaction during transmission. The sender and receiver can also use it to verify each other's identity. You can choose a TLS setting when sending email through Salesforce or through an email relay.
products:
  - Security
release: "264"
---
# Set Up Transaction Layer Security (TLS)

Transaction Layer Security (TLS) encrypts the contents of an email transaction during transmission. The sender and receiver can also use it to verify each other's identity. You can choose a TLS setting when sending email through Salesforce or through an email relay.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions except <strong>Database.com</strong></td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permissions">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d90855e60">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d90855e60 ">To configure email deliverability:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d90855e60 ">Customize Application</td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)

Note Salesforce no longer supports TLS versions 1.1 or 1.0. If the receiving mail server only supports TLS 1.1 or 1.0 ciphers, then the email is sent unencrypted unless the sending org has specified that TLS is required.

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Deliverability**.
2. In the Transport Layer Security (TLS) (Emails from Salesforce or Email Relay Only) section, select your TLS Setting:
    - **Preferred**—If the message transfer agent (MTA) advertises TLS and a common cipher can be negotiated, TLS is used. If TLS can’t be negotiated, the email is delivered unencrypted. This setting is the default.
    - **Required**—If TLS can’t be negotiated or a common cipher can’t be agreed on, the email bounces back to the originator.
    - **Preferred Verify**—If the MTA advertises TLS, a common cipher can be negotiated, and Salesforce can verify the receiver, TLS is used. Verification means that a valid certificate authority has signed the receiver’s certificate and the hostname in the certificate matches the host to which we connected. If TLS can’t be negotiated or the verification fails, the email is delivered unencrypted.
    - **Required Verify**—If TLS can’t be negotiated, a common cipher can’t be agreed on, or the sender can’t be verified, the email bounces back to the originator. Verification means that a valid certificate authority has signed the receiver’s certificate and the hostname in the certificate matches the host to which we connected.
3. Optionally, if you selected a setting other than Preferred, you can select **Restrict TLS to these domains** and enter the comma-separated list of domains. When delivering to domains that aren’t listed, we use the "Preferred" setting.
4. Click **Save**.

#### See Also

- [Email Security Mechanisms](https://help.salesforce.com/s/articleView?id=xcloud.emailadmin_security_mechanisms.htm&release=264.0.0&type=5 "Salesforce supports several email security mechanisms: Transaction Layer Security (TLS), Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Each mechanism protects different aspects of an email message.")