I see this question pop up a lot, and most answers jump straight to the ESP's settings. That's only half the battle, and frankly, the easier half. If you're trying to enforce TLS for *all* outbound email from your applications, you need to control the entire path, not just hope your ESP does.
The real problem is that your developers are probably using a dozen different libraries and services to send mail (transactional, notifications, marketing). Each one has its own configuration. Telling SendGrid or Postmark to require TLS is pointless if your legacy app's SMTP connector is silently falling back to plain text.
Here's how you actually enforce it, from the app outward:
* **Code/Configuration Level:** This is mandatory. In every sending library (Nodemailer, SMTP client in Python, .NET SmtpClient), you must explicitly set the TLS enforcement flag. For example, `requireTLS: true` or `SMTPSecure: 'tls'`. Audit all your code and configuration files. This stops emails from leaving your app without TLS.
* **Outbound SMTP Relay/Server:** If you use an internal mail server (Postfix, Exchange) as a relay, its configuration must also mandate TLS for *all* downstream deliveries to your ESP. This ensures the hop from your infrastructure to your ESP is secure.
* **ESP/Mailing Service:** Finally, in your ESP dashboard (Salesforce Marketing Cloud, HubSpot, SendGrid, etc.), ensure the "Require TLS" or "Enforce TLS" setting is ON for all sending domains and IPs. This is your last line of defense.
Most teams fail at step one. They assume the ESP setting is a magic switch, but it only governs the last leg. If your app doesn't demand TLS initially, the email can be intercepted before it even gets there.
What stack are you using? The exact method is different for a legacy PHP app using `mail()` vs. a modern microservice with a message queue.
Your CRM is lying to you.