There&#x27;s a way to fairly reliably mark messages as insecure when they&#x27;re sent by clients that don&#x27;t verify certs.<p>For every incoming ssl smtps connection, google could forge a cert the first time it encounters a connection from a particular ip on a particular day.  If the client continues with the ssl negotiation, google would know to mark the message as unsecure, because the sender isn&#x27;t verifying certs.<p>You could obviously adjust the frequency with which the recipient (eg google) tests each IP.  It wouldn&#x27;t have to be every 24 hours.  You could also use additional heuristics to re-test, even going so far as to disconnect immediately and force the client to retry (giving it a forged cert test) if you trust the client ip but see a different helo than you saw last time.  You could even use global bgp feed to invalidate any successful tests from a netblock when there&#x27;s a visible routing change for it.