When an email recipient server (say server-A) is configured to forward to another email addresses (on say server-B), is
TLS applied all the way up to server-B, or does it end at server-A, or something else?
Below I'm sharing my rather concrete example to help giving more context for my question, but this is only an example and the essense of my question is above.
I have a forward-only email address my college operates for alumni, and I set it to forward to my
gmail.com address. Looks like
TLS has been failing for awhile, some emails in my gmail inbox viewed on GMail's web user-interface I notice the security error saying
"'server-A' did not encrypt this message". It's been happening presumably since when GMail added "security" option...AFAICT some emails back in 2016 I already see the error.
Then, recently I switched the forward target from gmail to an address with
googlegroups.com, which eventually delivers to the same gmail.com address. Then on GMail I/F, I stopped seeing the "security" error. In this case, is TLS covering end-to-end (i.e. in my case, sender -> server-A address -> googlegroups.com -> my gmail.com)? Or only to some extent?
Update 2022/05/22 In addition to the useful answers and comments, one of which I accepted as an answer, I found this article is exhaustive and useful (luxsci.com).