So I had created a different thread about PKI/client-side/data at rest security, but I wanted to ask about more reasonable amounts of security.
I know that horrible mail servers exist where they’re configured to not even be capable of TLS/SSL. I know there’s an option in Postfix to have security as a may, must (or “yes”, I forget), and no. Since humanity hates itself, we still allow security as a may to be acceptable, since we feel sorry for horrible system administrators.
However, I imagine there are many scenarios where sensitive data may need to be sent via email. In which case, I wanted to know if it were possible to have a domain for “may” security (example.com) and another domain for “must” security (secure.example.com), where it would reject any incoming/outgoing insecure MTA-to-MTA communication. Like, I would want to register my Paypal account with email@example.com and maybe put firstname.lastname@example.org on a business card, for the dum dums who still use mail providers that don’t enable security. If a conversation escalated with a person, I would ask that person to start sending mail to secure.example.com or maybe change the reply-to and sent-from fields, so that it could smoothly transition between the two mail accounts (I would probably want to configure my box to manage both accounts using the same inbox/sent/draft/spam/junk stuff).
EDIT: also, is it possible to auto-send back an unencrypted error email, saying something to the effect of “Sorry, but your mail server does not support security. This is a secure mail server. Please either use another mail account on a mail server with enabled security, or contact your mail server administrator about enabling security on your server.” for users who attempt to send mail that don’t allow secure mail?