Hello,
i had a security mail gateway, that checks incomming Mails.
And this system told me, that die Mail Flow not total secured by TLS is.
So i checked the Mail Headers.
a bit simplified here:
New Mail by External Sender to my Root Server (host1.domain.net) by TLS - OK
next Step...