This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop connection".
We can use checktls.com/TestReceiver to check if the mail server supports STARTTLS.
But how do I find out if it enforces it? I basically need to check that the server, when the other side does not support STARTTLS, drops the email rather than downgrading to unencrypted transfer.
I have to do Black Box penetration/security test of this mail server, so I do not have access to inside configuration of the server. I am also a newbie and am just studying, learning and doing, as we don't live in an ideal world, where i would have the luxury of studying just this topic for months and then do it.
EDIT: There is a confusion about whether I am talking about inbound or outbound emails. I am sorry, actually I am new to this, so I wasn't clear enough in my questioning.
I am talking about both inbound and outbound emails. The problem is that the owner of the mail server thinks/knows that their data is being sniffed. So what we need is that any email going out of this mail server, or any email that is coming into this mail server, should not be sniffed/caught in plaintext under any circumstance.
Say this mail server is webmail.abc.com. So what we want is that any emails originating from users of that mail server, or any emails that are intended for users of that mail server, must never get UNencrypted under any circumstance.