+.PP
+The mail transport system default is provided in
+.I %nmhetcdir%/mts.conf
+but can be overridden here with the
+.B \-mts
+switch.
+.PP
+If nmh is using as its mail transport system
+.BR sendmail/pipe ,
+the
+.B \-sendmail
+switch can be used to override the default
+.B sendmail
+program.
+.PP
+If nmh is using the SMTP MTA, the
+.B \-server
+and the
+.B \-port
+switches can be used to override the default mail server (defined by the
+.I %nmhetcdir%/mts.conf
+.RI servers
+entry). The
+.B \-snoop
+switch can be used to view the SMTP transaction. (Beware that the
+SMTP transaction may contain authentication information either in
+plaintext or easily decoded base64.) If
+.B \-sasl \-saslmech xoauth2
+is used, the HTTP transaction is also shown.
+.PP
+If
+.B nmh
+has been compiled with SASL support, the
+.B \-sasl
+and
+.B \-nosasl
+switches will enable and disable
+the use of SASL authentication with the SMTP MTA. Depending on the
+SASL mechanism used, this may require an additional password prompt from the
+user (but the
+.I netrc
+file can be used to store this password, as described in the
+mh-profile(5) man page). The
+.B \-saslmech
+switch can be used to select a particular SASL mechanism,
+and the
+.B \-user
+switch can be used to select a authorization userid to provide to SASL
+other than the default. The credentials profile entry in the
+mh\-profile(5) man page describes the ways to supply a username and
+password.
+.PP
+If SASL authentication is successful,
+.BR nmh
+will attempt to negotiate a security layer for session encryption.
+Encrypted data is labelled with `(encrypted)' and `(decrypted)' when
+viewing the SMTP transaction with the
+.B \-snoop
+switch; see the
+.B post
+man page description of
+.B \-snoop
+for its other features.
+.PP
+If
+.B nmh
+has been compiled with OAuth support, the
+.B \-sasl
+and
+.B \-saslmech xoauth2
+switches will enable OAuth authentication. The
+.B \-user
+switch must be used, and the
+.I username
+must be an email address the user has for the service, which must
+be specified with the
+.B \-authservice
+.I service
+switch. Before using OAuth authentication, the user must authorize nmh by
+running
+.B mhlogin
+and grant authorization to that account. See the
+.IR mhlogin (1)
+man page for more details.
+.PP
+If
+.B nmh
+has been compiled with TLS support, the
+.B \-tls
+and
+.B \-initialtls
+switches will require the negotiation of TLS when
+connecting to the SMTP MTA. The
+.B \-tls
+switch will negotiate TLS as part of the normal SMTP protocol
+using the STARTTLS command. The
+.B \-initialtls
+will negotiate TLS immediately after the connection has
+taken place, before any SMTP commands are sent or received. Encrypted data
+is labelled with `(tls-encrypted)' and
+`(tls-decrypted)' when viewing the SMTP transaction with the
+.B \-snoop
+switch; see the
+.B post
+man page description of
+.B \-snoop
+for its other features.
+The
+.B \-notls
+switch will disable all attempts to negotiate TLS.
+.PP
+If port 465 is specified and none of the TLS switches were enabled,
+.B \-initialtls
+will be implied if TLS support was compiled in. Though port 465 for
+SMTPS (SMTP over SSL) was deregistered by IANA in 1998, it is still
+used for that service.
+.PP
+When using TLS the default is to verify the remote certificate and SubjectName
+against the local trusted certificate store. This can be controlled by
+the
+.B \-certverify
+and
+.B \-nocertverify
+switches. See your OpenSSL documentation for more information on certificate
+verification.
+.PP