diff --git a/draft-ietf-masque-connect-ip.md b/draft-ietf-masque-connect-ip.md
index 2e94d58..1289ba3 100644
--- a/draft-ietf-masque-connect-ip.md
+++ b/draft-ietf-masque-connect-ip.md
@@ -210,6 +210,9 @@ HTTP-DGRAM}}), IP proxying requests do not carry any message content.
 Similarly, successful IP proxying responses also do not carry any message
 content.
 
+IP proxying over HTTP MUST be operated over TLS or QUIC encryption, or another equivalent
+encryption protocol, to provide confidentiality, integrity, and authentication.
+
 ## IP Proxy Handling
 
 Upon receiving an IP proxying request: