Note that this is indeed almost always, rather than actually always. My mail server is configured to refuse to send to Google (and a few other hand-picked site

Note that this is indeed almost always, rather than actually always. My mail server is configured to refuse to send to Google (and a few other hand-picked sites) unless protected by SSL. The converse is, unfortunately, not yet true. DANE[0] should allow me to put DNSSEC secured records in place to tell Google (et al) that they should always use SSL to talk to me too, but I don't have DNSSEC support for my domains yet and my version of Postfix isn't new enough to be able to use it for outgoing mail either. More frustratingly, many popular email providers (for example, BT) don't support SSL at all. That lowers the bar for eavesdropping from active MITM to passive listening. 0: http://www.internetsociety.org/deploy360/resources/dane/ http://www.internetsociety.org/deploy360/resources/dane/