STARTTLS on port 25 is vulnerable to active MITM anyway, so having your certificate signed by a big CA doesn't really get you much. For delivery over port 465 i

STARTTLS on port 25 is vulnerable to active MITM anyway, so having your certificate signed by a big CA doesn't really get you much. For delivery over port 465 it makes sense, but an active MITM could still block your connection and see if you fall back to STARTTLS on 25. Fastmail have a good summary of the current situation[0]. And, as Sami_Lehtinen said, many servers out there probably have self-signed certs. [0] https://www.fastmail.fm/help/technical/ssltlsstarttls.html https://www.fastmail.fm/help/technical/ssltlsstarttls.html