Re: Servers that just want to have TLS

> S: <waits for connection on TCP port 25>
> C: <opens connection>
> C & S: <start TLS session>
> C & S: <check result of negotiation>
> S: 220 mail.imc.org SMTP service ready
> 
> I tend think this is a bad idea on any well-known port for which a client
> might expect a non-TLS session. In the case of a non-TLS client, it would
> start getting a stream of gibberish that it could not deal with at all. A
> well-crafted SMTP client should do something like "The first thing it said
> to me wasn't 220, so I'll just leave", but I'm not sure that many will do
> this if handed a binary stream from the server.

The cleanest approach is a 5xx error message on anything but EHLO and STARTTLS 

...and perhaps AUTH XXX, where XXX is some form of authentication which offers
equivalent protection services.