security verifiedimportant

Four positions, from Never — use plain SMTP through Opportunistic (STARTTLS when offered), Encrypted (STARTTLS required, any certificate accepted) to Secured (STARTTLS with strict cipher and certificate checks). The middle position is where almost all bulk mail lives: encrypt when the receiver allows, never refuse to deliver over it. The strict positions turn a receiver's expired certificate into undelivered mail, which is a policy decision a customer should make knowingly — and one their recipients cannot see. The Not secure counter in the console counts deliveries that went unencrypted where the setting would have allowed encryption, which is the measurement to look at before tightening this.