diff --git a/src/core/coap/coap_secure.cpp b/src/core/coap/coap_secure.cpp
index a7e490ba9..9ed3c8b99 100644
--- a/src/core/coap/coap_secure.cpp
+++ b/src/core/coap/coap_secure.cpp
@@ -229,18 +229,12 @@ void CoapSecureBase::HandleTransmit(void)
         mTransmitTask.Post();
     }
 
-    SuccessOrExit(error = mDtls.Send(*message, message->GetLength()));
+    SuccessOrExit(error = mDtls.Send(*message));
+    LogDebg("Transmit");
 
 exit:
-    if (error != kErrorNone)
-    {
-        LogNote("Transmit: %s", ErrorToString(error));
-        message->Free();
-    }
-    else
-    {
-        LogDebg("Transmit: %s", ErrorToString(error));
-    }
+    FreeMessageOnError(message, error);
+    LogWarnOnError(error, "transmit");
 }
 
 } // namespace Coap
diff --git a/src/core/meshcop/secure_transport.cpp b/src/core/meshcop/secure_transport.cpp
index fa73bf760..18b8787f7 100644
--- a/src/core/meshcop/secure_transport.cpp
+++ b/src/core/meshcop/secure_transport.cpp
@@ -470,22 +470,18 @@ exit:
     return error;
 }
 
-Error SecureTransport::Send(Message &aMessage, uint16_t aLength)
+Error SecureTransport::Send(Message &aMessage)
 {
-    Error   error = kErrorNone;
-    uint8_t buffer[kApplicationDataMaxLength];
+    Error    error  = kErrorNone;
+    uint16_t length = aMessage.GetLength();
+    uint8_t  buffer[kApplicationDataMaxLength];
 
-    VerifyOrExit(aLength <= kApplicationDataMaxLength, error = kErrorNoBufs);
+    VerifyOrExit(length <= sizeof(buffer), error = kErrorNoBufs);
 
-    // Store message specific sub type.
-    if (aMessage.GetSubType() != Message::kSubTypeNone)
-    {
-        mMessageSubType = aMessage.GetSubType();
-    }
+    mMessageSubType = aMessage.GetSubType();
+    aMessage.ReadBytes(0, buffer, length);
 
-    aMessage.ReadBytes(0, buffer, aLength);
-
-    SuccessOrExit(error = Crypto::MbedTls::MapError(mbedtls_ssl_write(&mSsl, buffer, aLength)));
+    SuccessOrExit(error = Crypto::MbedTls::MapError(mbedtls_ssl_write(&mSsl, buffer, length)));
 
     aMessage.Free();
 
diff --git a/src/core/meshcop/secure_transport.hpp b/src/core/meshcop/secure_transport.hpp
index c4f395742..b8d801904 100644
--- a/src/core/meshcop/secure_transport.hpp
+++ b/src/core/meshcop/secure_transport.hpp
@@ -481,15 +481,17 @@ public:
     Error SetPsk(const uint8_t *aPsk, uint8_t aPskLength);
 
     /**
-     * Sends data within the session.
+     * Sends message to the secure session.
      *
-     * @param[in]  aMessage  A message to send via connection.
-     * @param[in]  aLength   Number of bytes in the data buffer.
+     * When successful (returning `kErrorNone`), this method takes over the ownership of @p aMessage and will free it
+     * after transmission. Otherwise, the caller keeps the ownership of @p aMessage.
      *
-     * @retval kErrorNone     Successfully sent the data via the session.
-     * @retval kErrorNoBufs   A message is too long.
+     * @param[in]  aMessage   A message to send.
+     *
+     * @retval kErrorNone     Successfully sent the message.
+     * @retval kErrorNoBufs   @p aMessage is too long.
      */
-    Error Send(Message &aMessage, uint16_t aLength);
+    Error Send(Message &aMessage);
 
     /**
      * Returns the session's peer address.
diff --git a/src/core/radio/ble_secure.cpp b/src/core/radio/ble_secure.cpp
index f7c2d9cf1..049330199 100644
--- a/src/core/radio/ble_secure.cpp
+++ b/src/core/radio/ble_secure.cpp
@@ -468,18 +468,12 @@ void BleSecure::HandleTransmit(void)
         mTransmitTask.Post();
     }
 
-    SuccessOrExit(error = mTls.Send(*message, message->GetLength()));
+    SuccessOrExit(error = mTls.Send(*message));
+    LogDebg("Transmit");
 
 exit:
-    if (error != kErrorNone)
-    {
-        LogNote("Transmit: %s", ErrorToString(error));
-        message->Free();
-    }
-    else
-    {
-        LogDebg("Transmit: %s", ErrorToString(error));
-    }
+    FreeMessageOnError(message, error);
+    LogWarnOnError(error, "transmit");
 }
 
 Error BleSecure::HandleTransport(void *aContext, ot::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
diff --git a/tests/nexus/test_dtls.cpp b/tests/nexus/test_dtls.cpp
index f9f5f24ae..13904a4b3 100644
--- a/tests/nexus/test_dtls.cpp
+++ b/tests/nexus/test_dtls.cpp
@@ -223,7 +223,7 @@ void TestDtls(void)
         {
             OwnedPtr<Message> msg(PrepareMessage(node0));
 
-            SuccessOrQuit(dtls0.Send(*msg->Clone(), msg->GetLength()));
+            SuccessOrQuit(dtls0.Send(*msg->Clone()));
             nexus.AdvanceTime(100);
 
             VerifyOrQuit(sDtlsLastReceive[node1.GetId()].GetLength() == msg->GetLength());
@@ -237,7 +237,7 @@ void TestDtls(void)
         {
             OwnedPtr<Message> msg(PrepareMessage(node1));
 
-            SuccessOrQuit(dtls1.Send(*msg->Clone(), msg->GetLength()));
+            SuccessOrQuit(dtls1.Send(*msg->Clone()));
             nexus.AdvanceTime(100);
 
             VerifyOrQuit(sDtlsLastReceive[node0.GetId()].GetLength() == msg->GetLength());