 #opportunistic encryption s2s<p>smtp_tls_security_level = may<p>smtp_tls_CApath = &#x2F;etc&#x2F;ssl&#x2F;certs<p>This will use STARTTLS to upgrade the connection. This does not protect you against an active attacker, but it will protect you against passive eavesdropping (~mass surveillance).