It&#x27;s configurable, as you say. Maybe I don&#x27;t understand your argument &quot;at least you won&#x27;t be MITM&#x27;ed&quot;. Almost nobody runs SMTPS anyways. I&#x27;m just saying that if someone decides they want to enforce encrypted SMTP, it really doesn&#x27;t matter if that is implemented as mandatory STARTSSL vs SMTPS. One is not more suspectible to MITM than the other.