What I&#x27;m saying is that there&#x27;s no difference in STARTTLS and SMTPS. In either case, the client should drop the connection if it doesn&#x27;t manage to negotiate the desired transport encryption.<p>Whether that happens because it doesn&#x27;t get the expected response to STARTTLS or because the SMTPS port fails to respond with a proper TLS handshake is the same.<p>A &quot;downgrade attack&quot; only works if the client decides to keep going after failing to establish encryption. This is a client policy configuration issue, and has nothing to do with whether one uses the bytes &quot;HELO server\r\nSTARTTLS\r\n&quot; or a raw TLS handshake to negotiate the connection after opening the TCP port.