Servers that just want to have TLS

This is related to Mike Macgirvin's question, and something that I don't
have in the current SMTP/TLS draft. The resolution of it shoul be
applicable to all apps over TLS topics.

What should a server do if it *only* wants to talk TLS? This is a server on
the standard port, not a TLS-only port. I considered adding something to
the SMTP draft that said someting to the effect of:

If the client doesn't give a STARTTLS command and the server will only talk
after a sucessful TLS handshake, the server should constantly reply to
every command with 567 (or some such new number) codes until the client
either issues a STARTTLS or issues a QUIT.

Now, this clearly won't work for an SMTP server that is the terminal relay
for any domain that the outside world wants to send mail to. But it could
be desired, or even required, within some closed systems, such as for mail
submission. Further, such a server might be used by private agreement, and
it wants to tell anyone outside the private agreement to go away.

The issue is more valuable for things like IMAP servers. I can certainly
see some companies having two IMAP servers, one at "tls.imap.foo.com" and
the other at "unsafe.imap.foo.com". Only certain logins would be allowed at
"unsafe." (such as for public mailboxes or low-priority people) while all
logins would be accepted at "tls.". The server needs a way to tell a client
that doesn't do a STARTTLS (or whatever we end up putting into the IMAP/TLS
spec) "tell me to start TLS, or go away".

As you can tell, I'm not completely settled on this. Comments are welcome.

--Paul E. Hoffman, Director
--Internet Mail Consortium