We have enabled email relay in our organization. Recently our security team performed a scan of our salesforce instance and has asked us to change the TLS (Transport Layer Security) setting. Earlier it was set to "Preferred"(which I guess is default). Now we are asked to change it to "Required".

I wanted to understand the implications of doing so before we actually change the setting. I checked the documentation and it states salesforce will terminate the session if TLS is unavailable. This means email will not be sent. Will salesforce notify us in such cases? Or Is there any setting to be enabled by which we can get notified.

1 Answer 1


TLDR - Yes, Salesforce will log emails that fail as a result of TLS being unavailable; this includes if TLS is unavailable is a result of "Required" being selected in the TLS setting and the outbound server failing to support TLS.

First, might be worth quoting Salesforce's email deliverability setting docs you're referencing:

To configure the email deliverability settings for your organization:


  1. To specify how Salesforce uses the Transport Layer Security (TLS) protocol for secure email communication for SMTP sessions, choose one of the following:

Required Verify: Salesforce continues the session only if the remote server offers TLS, the certificate is signed by a valid certificate authority, and the common name presented in the certificate matches the domain or mail exchange to which Salesforce is connected. If any of these criteria are not met, Salesforce terminates the session without delivering the email.

Note: If you select a setting other than Preferred (the default setting), select Restrict TLS to these domains and specify a comma-separated domain list. The asterisk (*) wildcard is allowed; for example, *.subdomains.com matches [email protected] and [email protected] (but not [email protected]). If you don't specify domains, Salesforce uses the TLS setting you specify for all outbound emails, which may result in emails not being delivered.

Important: If you plan to use Transport Layer Security (TLS) with this connection, enter the host name instead of the IP address. TLS requires the host name for verifying certificates

(source-1, source-2)

Next what you're looking is to know if Salesforce will log the failure in a way that you're able to tell the failure was a result of TLS connection failure. Salesforce logs this is the EmailBouncedReason field, which is within the Contact & Lead objects.

Next you need to know the email delivery code for a TLS connection error, here's the list of Salesforce's Mail None Delivery (NDR) codes & Pardot's Bounce Codes; Pardot was acquired by Salesforce when it acquired ExactTarget. You'll notice that none of these code explicitly list TLS failure as an explanation, but it appears likely that a failure would be coded as "451 The command has been aborted due to a server error. Not your fault."

To get a report of the contacts that bounced, see "How can I get a list of contacts whose email message bounced?"

If you want to confirm this, you'll have to setup or find a external system were TLS is not supported, but were the service is valid; which you can check using free online tools like CheckTLS or SSL-Tools. If possible, given security made the request, beyond you confirm that you "checked a box" - ask them if they will supply a way to confirm Salesforce is really enforcing that "checked a box" - since it's always possible they're not (aka "goto fail").


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .