Google Message Security for Google Apps Administration Guide - Manual (Page 303)

Transport Layer Security 303
If a message is sent via TLS, the message security service delivers the
message via TLS to Google Apps Mail if possible, but otherwise delivers by
SMTP. If the message is sent via SMTP, the message security service
delivers the message via SMTP to Google Apps Mail, so the message is
delivered to match the sender’s preference if possible. This is the
recommended setting. It ensures end-to-end TLS connections, and the
impact to performance is relatively low.
• Send by TLS if possible
All messages are delivered from the message security service to Google
Apps Mail using TLS if possible. Recipient servers that do not support TLS
receive their mail via SMTP. Messages, whether sent via SMTP or TLS are
encrypted and sent via TLS from the message security service.
• Send by TLS Only
Send all messages by TLS. Mail sent to recipient servers that do not support
TLS will be deferred. This impacts server performance.
3. If you wish to set up specific domains for TLS, enter domain names in Domain
Specific Settings. See “Setting Up Policy Enforced TLS” on page 311 for more
information.