There's a way to fairly reliably mark messages as insecure when they're sent by clients that don't verify certs. For every incoming ssl smtps connection, googl

There's a way to fairly reliably mark messages as insecure when they're sent by clients that don't verify certs. For every incoming ssl smtps connection, google could forge a cert the first time it encounters a connection from a particular ip on a particular day. If the client continues with the ssl negotiation, google would know to mark the message as unsecure, because the sender isn't verifying certs. You could obviously adjust the frequency with which the recipient (eg google) tests each IP. It wouldn't have to be every 24 hours. You could also use additional heuristics to re-test, even going so far as to disconnect immediately and force the client to retry (giving it a forged cert test) if you trust the client ip but see a different helo than you saw last time. You could even use global bgp feed to invalidate any successful tests from a netblock when there's a visible routing change for it.