On Wed, May 05, 2010 at 07:27:46PM +0100, Kevin Chadwick wrote:
quoted text
> Of course, if it's your mail server and clients you can use ips without
> dns have certficates tied to those ips and even block or monitor resets,
> none of which can be done with starttls and it is also a smaller window
> of opportunity. You can always reset the starttls too and man in the
> middle that, just one less opportunity.
> 

If it's your mail server and clients you can just force certificate
checking on the hosts you want to connect to with tls. Using a different
port adds no cryptographic security (authentication) at all, so it's
useless complexity.