#opportunistic encryption s2s smtp_tls_security_level = may smtp_tls_CApath = /etc/ssl/certs This will use STARTTLS to upgrade the connection. This does not

#opportunistic encryption s2s smtp_tls_security_level = may smtp_tls_CApath = /etc/ssl/certs This will use STARTTLS to upgrade the connection. This does not protect you against an active attacker, but it will protect you against passive eavesdropping (~mass surveillance).