They are completely unencrypted, just on the initial and the last "mile" the TRANSPORT layer is (sort of) encrypted.