> Does anyone know if that would stop this problem? Based on my experiences with Dovecot, I believe it would, > Saying that, someone with MITM capability coul

> Does anyone know if that would stop this problem? Based on my experiences with Dovecot, I believe it would, > Saying that, someone with MITM capability could just modify the response and advertise auth pre-tls, so it probably wouldn't help. Well, hopefully your client isn't braindead and will negotiate an encrypted session first, before sending credentials unencrypted -- especially if you've configured it to use STARTTLS.