In your MEG message search, you can see the disposition of a message and how it was delivered.  In the properties column, there are a few icons that can tell you if it was inbound vs outbound, original vs modified and if it was delivered securely. 


The color of the lock icon tells you if it was delivered via opportunistic TLS or via a policy action.  If the icon is black, then it was via opportunistic TLS configured under Email - Encryption - TLS.  In this case, it can be either a domain where TLS is forced or the * option.  If the icon is gold, then it was triggered via a policy action to encrypt and delivered via the options under Email - Email Policies - Policy Options - Encryption Settings.


Gold Lock = Policy based action

Black Lock = Domain based rule or opportunistic TLS