The dirty secret nobody wants to talk about is that MTA's don't do certificate validation. You can't or you'd never deliver email successfully because of the number of self signed certs out there.
MITM on SSL/TLS SMTP is child's play
MITM on SSL/TLS SMTP is child's play
mike@snake:~$ dig +short mx grepular.com
20 mail.grepular.com.
10 mx1.grepular.com.
mike@snake:~$ dig +short tlsa _25._tcp.mx1.grepular.com
2 1 1 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18
2 1 1 B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B
mike@snake:~$ dig +short tlsa _25._tcp.mail.grepular.com
2 1 1 B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B
2 1 1 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18
mike@snake:~$Try working with small businesses, lawyers, etc who self-host. It will fail and clients will scream bloody murder unless you turn off validation so their emails can get delivered.
Let's Encrypt in particular seems to be more geared toward websites, but I actually did manage to put it to use rather trivially on my mailserver (which previously used self-signed certs) thanks to 'acme-client' on OpenBSD.