So, this is require-tls-on-first-ns-lookup? If dns isn't mitm'd, you'd get a flag requiring tls;this can/should be cached - and fallback to plaintext smtp (no t

So, this is require-tls-on-first-ns-lookup? If dns isn't mitm'd, you'd get a flag requiring tls;this can/should be cached - and fallback to plaintext smtp (no tls) be disabled? Is that the gist?