Very cool stuff. Unfortunately, can't really deploy verification on production because of "WARNING: this is a pre-alpha codebase. Do not run it on production mailservers!!!" in https://github.com/EFForg/starttls-everywhere
Port 465 is for smtps : SSL encryption is started automatically before any SMTP level communication.
Port 587 is for msa : It is almost like standard SMTP port. MSA should accept email after authentication (e.g. after SMTP AUTH). It helps to stop outgoing spam when netmasters of DUL ranges can block outgoing connections to SMTP port (port 25). SSL encryption may be started by STARTTLS command at SMTP level if server supports it and your ISP does not filter server's EHLO reply (reported 2014).
cf https://stackoverflow.com/questions/15796530/what-is-the-dif...