Announcing STARTTLS Everywhere: Securing Hop-To-Hop Email Delivery

You can do that right now if you close port 25 and just keep port 465. However, you may miss some emails. The same will happen when the code is no longer pre alpha, as per the RFC encryption is optional on port 25 and 587. Making it mandatory means some servers will not be able to talk to yours.

Port 465 is for smtps : SSL encryption is started automatically before any SMTP level communication.

Port 587 is for msa : It is almost like standard SMTP port. MSA should accept email after authentication (e.g. after SMTP AUTH). It helps to stop outgoing spam when netmasters of DUL ranges can block outgoing connections to SMTP port (port 25). SSL encryption may be started by STARTTLS command at SMTP level if server supports it and your ISP does not filter server's EHLO reply (reported 2014).

cf https://stackoverflow.com/questions/15796530/what-is-the-dif...