Google Message Security for Google Apps Administration Guide - Manual (Page 297)

Transport Layer Security 297
The key features of TLS are:
• Encrypted messages:
TLS uses Public Key Infrastructure (PKI) to encrypt messages from mail
server to mail server. This encryption makes it more difficult for hackers to
intercept and read messages.
• Authentication:
TLS supports the use of digital certificates to authenticate the receiving
servers. Authentication of sending servers is optional. This process verifies
that the receivers (or senders) are who they say they are, which helps to
prevent spoofing.
How Inbound TLS Works
For inbound mail traffic, the message security service acts as a proxy between the
sending server and Google Apps Mail. Inbound messages are received through
two separate SMTP connections.The first connection is from the sending server to
the message security service. The second connection is from the message
security service to the Google Apps Mail server. These connections are also
sometimes called “hops” since data is relayed from one server to the next in a
series.