In SMTP the client sends EHLO, sees 250-STARTTLS in the capability list, sends STARTTLS, and the TLS handshake runs on the same TCP connection (port 25 between servers, 587 for submission). Between mail servers it is opportunistic: an on-path attacker can strip the capability and the sender continues in plaintext, and senders typically accept any certificate.
Fixes come from policy layers: MTA-STS (RFC 8461) and DANE (RFC 7672) let a receiving domain demand authenticated TLS, and TLS-RPT (RFC 8460) reports failures. For client access, RFC 8314 recommends implicit TLS (ports 465, 993, 995) over STARTTLS. Implementation bugs such as command injection before the upgrade (buffered plaintext processed as if it arrived over TLS) have affected many mail servers.
openssl s_client -starttls smtp -connect mx.example.com:25 shows the certificate and negotiated parameters; the STARTTLS checker runs the same test.