Google Message Security for Google Apps Administration Guide - Manual (Page 299)

Transport Layer Security 299
Message Processing and Encryption
The following describes message flow, encryption, and message filtering for
incoming TLS connections. (Note, this is a high-level overview; please see the
TLS specification, RFC 2246, or other technical reference for the complete data
flow.)
1. The sending server initiates a TLS connection with the message security
service. (TLS handshake with the message security service using the ESMTP
STARTTLS command.)
2. If the sending server attempts a TLS connection, the message security
service sends the certificate information, public key, and encryption
specifications to the sending server.
3. While keeping the connection open with the sender, the message security
service establishes a TLS connection with Google Apps Mail.