Yep - this spec outlines exactly how to tell another compliant MTA that it should use TLS with you, and how to detect (on subsequent connections) this type of M

Yep - this spec outlines exactly how to tell another compliant MTA that it should use TLS with you, and how to detect (on subsequent connections) this type of MITM. https://tools.ietf.org/html/rfc8461#section-10 https://tools.ietf.org/html/rfc8461#section-10 explains the threat model. Of course, to thwart an MITM of an initial connection, you'd need something like https://hstspreload.org/ https://hstspreload.org/ . And all the criticisms of a preload list apply here. Still, this is much better than nothing.