-switch can be used to select a authorization userid
-to provide to SASL other than the default.
-.PP
-Currently SASL security layers are not supported for SMTP.
-.BR nmh 's
-SMTP SASL code
-will always negotiate an unencrypted connection. This means that while the SMTP
-authentication can be encrypted, the subsequent data stream can not. This is in
-contrast to
-.BR nmh 's
-POP3 SASL support, where encryption is supported for both the
-authentication and the data stream.
+switch can be used to select a authorization userid to provide to SASL
+other than the default. The credentials profile entry in the
+mh_profile(5) man page describes the ways to supply a username and
+password.
+.PP
+If SASL authentication is successful,
+.BR nmh
+will attempt to negotiate a security layer for session encryption.
+Encrypted data is labelled with `(encrypted)' and `(decrypted)' when
+viewing the SMTP transaction with the
+.B \-snoop
+switch. The
+.B \-saslmaxssf
+switch can be used to select the maximum value of the Security Strength Factor.
+This is an integer value and the exact meaning of this value depends on the
+underlying SASL mechanism. A value of 0 disables encryption.
+.PP
+If
+.B nmh
+has been compiled with TLS support, the
+.B \-tls
+and
+.B \-initialtls
+switches will require the negotiation of TLS when
+connecting to the SMTP MTA. The
+.B \-tls
+switch will negotiate TLS as part of the normal SMTP protocol
+using the STARTTLS command. The
+.B \-initialtls
+will negotiate TLS immediately after the connection has
+taken place, before any SMTP commands are sent or received. Encrypted data
+is labelled with `(tls-encrypted)' and
+`(tls-decrypted)' when viewing the SMTP transction with the
+.B \-snoop
+switch.
+The
+.B \-notls
+switch will disable all attempts to negotiate TLS.