When an email client connects to an email server, it initially establishes a plain text connection. By issuing the STARTTLS command, the client requests to upgrade this connection to a secure one. If the server supports STARTTLS, it responds affirmatively and both parties negotiate the encryption protocol to use, such as TLS. Once established, all subsequent communications are encrypted.