I'd like to gracefully handle sendmail STARTTLS handshake failures. On outgoing mail, it would be best if there were an immediate retry without STARTTLS in the case of failure. On inbound mail, ideally a site that caused handshake failures would be whitelisted to not use STARTTLS in the future, though I realize this is likely impractical.
As an alternative in this specialized environment, a method to default to not using STARTTLS, and specify only specific sites/domains that would be offered STARTTLS for inbound and/or outbound mail, would likely suffice for now. Any suggestions appreciated. Thanks.