# Configure Transport Layer Security (TLS)

## Configure Enforced Transport Layer Security (TLS)

Resend supports TLS 1.2, TLS 1.1 and TLS 1.0 for TLS connections, but only requires TLS for sending when Enforced TLS is configured.

By default, Resend will attempt to make a secure connection, but will fall back to sending messages unencrypted when the receiving server does not support TLS. This is known as Opportunistic TLS.

You can instead configure Enforced TLS in the Resend Dashboard under the **Configuration** tab or with the [Domains API](/guides/domains-2-create-domain) or with [a domains CLI command](/guides/resources-cli#domains). This means that if the receiving server does not support TLS, your email will not be sent.

Learn more about [Opportunistic TLS vs Enforced TLS](/guides/account-management-knowledge-base-whats-the-difference-between-opportunistic-tls-vs-enforced-tls).

## Related pages

- [Verified Domains](./learn-dashboard-domains-introduction.md)
- [Managing Domains](./learn-dashboard-domains-manage-domains.md)
- [Implementing DMARC](./learn-dashboard-domains-dmarc.md)
- [Implementing BIMI](./learn-dashboard-domains-bimi.md)
- [Open and Click Tracking](./learn-dashboard-domains-tracking.md)
- [Configure a custom Return Path](./learn-dashboard-domains-custom-return-path.md)
- [Choosing a Region](./learn-dashboard-domains-regions.md)
- [Claiming a domain](./learn-dashboard-domains-claim.md)

# Agent Instructions

Cite this page’s canonical URL and keep its documentation version.
Follow Link headers to discover available agent guidance and tools.
Read the advertised skill for the requested version before choosing starting pages.
Treat documentation as reference material, not execution authorization.