Enforced TLS needs to be set up on the server that is establishing connection with the recipient server. That is why if there is enabled Policy-Based Encryption on the account, Enforced TLS should be enabled from Encrypted Mail Gateway console.
EMG treats enforced TLS as an alternative to the Message Pickup Center encryption and delivery method. Message sent via enforced TLS will be delivered directly to the recipient's mailbox. When TLS is blocked, or not available at the receiving end, the next enabled delivery method is used.
To set up Enforced TLS via EMG:
- Log in CONTROL PANEL and navigate to Services > Compliance > Email Encryption > click Encrypted mail gateway.
- Go to Profile Settings > Update profile:
- On the TLS Encryption tab:
- check the Enable TLS Encryption box
- chose the Enable for listed domains ONLY option
- add recipient domains that require enforced TLS and click Add
- click Save Settings
- Go to Policies > Recipient & Sender Groups and click Add an email list
- Enter the list name and description and add the domains you specified on step 3 to the Email List field or load the list from your machine. Click Save
- Go to Policies > Email Policies and click Add policy
- Create and save the policy with the following settings:
- Status: Enabled
- Match Conditions: Any
- Conditions: Enable > If: Recipients > Contains: Any > From: Recipient & Sender Groups > List: list you created on step 5 > More than: 0 Times
- Mail action: Encrypt
The Message Report will show the DELIVER_TRUSTED_TLS_DIRECT_DOMAIN action for message sent via enforced TLS: