Client command line tools like 'smbclient' as well as applications using
'libsmbclient' library have support for required encryption. This is activated
by the '-e|--encrypt' command line option or the
smbc_setOptionSmbEncryptionLevel() library call.

By default, only SMB1 is used in order to do connections to a server,
as the effective default for "client max protocol" smb.conf option
as well for the "-m|--max-protocol=" command line option is "NT1".

If the original client connection used encryption, following DFS
redirects to another server also enforce encryption. This is
important as these redirects are transparent to the application.

In case "SMB3", "SMB3_00", "SMB3_02", "SMB3_10" or "SMB3_11" is
used as max protocol and a connection actually made use of the
SMB3 encryption, any redirected connection looses the requirement
for encryption and maybe also the requirement for signing.
That means, a man in the middle can read and/or alter the content
of the connection.