+If
+.B nmh
+has been compiled with SASL support, the
+.B \-sasl
+switch will enable
+the use of SASL authentication with the SMTP MTA. Depending on the
+SASL mechanism used, this may require an additional password prompt from the
+user (but the
+.I netrc
+file can be used to store this password, as described in
+.IR mh-profile (5)).
+The
+.B \-saslmech
+switch can be used to select a particular SASL mechanism,
+and the
+.B \-user
+switch can be used to select a authorization userid to provide to SASL
+other than the default. The credentials profile entry in
+.IR mh\-profile (5)
+describes the ways to supply a username and
+password.
+.PP
+If SASL authentication is successful,
+nmh
+will attempt to negotiate a security layer for session encryption.
+Encrypted data is labelled with `(encrypted)' and `(decrypted)' when
+viewing the SMTP transaction with the
+.B \-snoop
+switch; see
+.IR post (8)'s
+description of
+.B \-snoop
+for its other features.
+.PP
+If
+.B nmh
+has been compiled with TLS support, the
+.BR \-tls ,
+.BR \-initialtls ,
+and
+.B \-notls
+switches will require and disable the negotiation of TLS support when connecting to the
+SMTP MTA. Encrypted data is labelled with `(tls-encrypted)' and
+`(tls-decrypted)' when viewing the SMTP transaction with the
+.B \-snoop
+switch; see
+.IR post (8)'s
+description of
+.B \-snoop
+and the TLS flags for more details.
+.PP