TLS where it can be negotiated. Encryption where it can't be skipped.

Two layers. Transport encryption between servers, enforced by policy. Message encryption for content that must stay sealed after delivery.

Transport: TLS on every hop

Spamjadoo offers STARTTLS on every inbound connection and requests it on every outbound one. Policy can go further: require TLS from specific sender domains, refuse plaintext for specific recipients, and honour the receiving domain's MTA-STS policy so a downgrade attack fails rather than silently succeeding.

Message: sealed at rest

For mail that must not be readable on the mail store, Spamjadoo encrypts the message body and attachments on the gateway before delivery, with keys held by the recipient organisation. Compliance teams get mail that is unreadable to anyone without the key, including the hosting provider.

What you can see

Every message log records whether the inbound and outbound hops were encrypted, which cipher was negotiated, and whether MTA-STS applied. Reports show the share of your mail that travelled in plaintext and which correspondents are responsible.

Practising it

spamjadoo.com publishes its own MTA-STS and TLS-RPT records. Check them with the MTA-STS and TLS-RPT tools when they go live, or with dig TXT _mta-sts.spamjadoo.com today.