client.go | 17 +++++++++++------
 config.go |  7 +++++--

diff --git a/client.go b/client.go
index 79409d721d1d51e65434e48b4d4174a20108264d..c4bf2812e39dacbcbd5c9b3297bc9106709f62a2 100644
--- a/client.go
+++ b/client.go
@@ -582,7 +582,8 @@ 	nc, utp := cl.dialFirst(addr, t)
 	if nc == nil {
 		return
 	}
-	c, err = cl.handshakesConnection(nc, t, !cl.config.DisableEncryption, utp)
+	encryptFirst := !cl.config.DisableEncryption && !cl.config.PreferNoEncryption
+	c, err = cl.handshakesConnection(nc, t, encryptFirst, utp)
 	if err != nil {
 		nc.Close()
 		return
@@ -590,12 +591,12 @@ 	} else if c != nil {
 		return
 	}
 	nc.Close()
-	if cl.config.DisableEncryption {
-		// We already tried without encryption.
+	if cl.config.DisableEncryption || cl.config.ForceEncryption {
+		// There's no alternate encryption case to try.
 		return
 	}
-	// Try again without encryption, using whichever protocol type worked last
-	// time.
+	// Try again with encryption if we didn't earlier, or without if we did,
+	// using whichever protocol type worked last time.
 	if utp {
 		nc, err = cl.dialUTP(addr, t)
 	} else {
@@ -605,7 +606,7 @@ 	if err != nil {
 		err = fmt.Errorf("error dialing for unencrypted connection: %s", err)
 		return
 	}
-	c, err = cl.handshakesConnection(nc, t, false, utp)
+	c, err = cl.handshakesConnection(nc, t, !encryptFirst, utp)
 	if err != nil || c == nil {
 		nc.Close()
 	}
@@ -851,6 +852,10 @@ 				err = nil
 			}
 			return
 		}
+	}
+	if cl.config.ForceEncryption && !c.encrypted {
+		err = errors.New("connection not encrypted")
+		return
 	}
 	ih, ok, err := cl.connBTHandshake(c, nil)
 	if err != nil {
diff --git a/config.go b/config.go
index 8b180fdc933bd582f0caf0d8f0e618dda3c93abc..dbcdbd137feb430785f6b5b5c44f6ea542a4cbdc 100644
--- a/config.go
+++ b/config.go
@@ -36,8 +36,11 @@ 	DisableTCP bool `long:"disable-tcp"`
 	// Called to instantiate storage for each added torrent. Builtin backends
 	// are in the storage package. If not set, the "file" implementation is
 	// used.
-	DefaultStorage    storage.ClientImpl
-	DisableEncryption bool `long:"disable-encryption"`
+	DefaultStorage storage.ClientImpl
+
+	DisableEncryption  bool `long:"disable-encryption"`
+	ForceEncryption    bool // Don't allow unobfuscated connections.
+	PreferNoEncryption bool
 
 	IPBlocklist iplist.Ranger
 	DisableIPv6 bool `long:"disable-ipv6"`