That's not always true, and with more and more hosts supporting key pinning technologies like DANE, it'll be less true with time. My mail server is set up to k

That's not always true, and with more and more hosts supporting key pinning technologies like DANE, it'll be less true with time. My mail server is set up to know that mail to Google domains (and others, like those hosted by Google or Microsoft) must be encrypted and the certificate must be correct. I occasionally look through my server logs to find more domains I can add to the list.