You don&#x27;t enforce STARTTLS receiver-side (smtpd).  You enforce it sender-side (smtp) by looking up the receiver&#x27;s policy using DNSSEC&#x2F;DANE.  This is allowed by the RFC and is implemented in Postfix.  I&#x27;ve been running this on my personal mailservers for over a year.<p>All you need is a DNSSEC resolver and two lines of Postfix configuration to get it working:<p><pre><code>    smtp_dns_support_level = dnssec
    smtp_tls_security_level = dane
</code></pre>
<a href="http:&#x2F;&#x2F;www.postfix.org&#x2F;postconf.5.html#smtp_tls_security_level" rel="nofollow">http:&#x2F;&#x2F;www.postfix.org&#x2F;postconf.5.html#smtp_tls_security_lev...</a>