amaccuish In the default configuration installed from the ISO, postfix's main.cf has smtp_enforce_tls = no and smtp_tls_security_level is missing, such that STARTTLS is not advertised to other MX servers. TLS is only used for submission. smtp_tls_security_level should at least be set to may.