Well it's very strange, their server doesn't always communicate normally...

The sender only provided this one line of their log:

xxxxxx@xxxxx.com... Deferred: 403 4.7.0 TLS handshake failed.

Our own Mercury logs vary, usually the connection starts fine with an EHLO followed by STARTTLS followed by the usual DATA and stuff.  However, their server almost never (but sometimes does) sends a QUIT so almost all connections end up taking 35+ seconds to timeout before the mail is delivered.

As far as I can tell, the STARTTLS almost always gets logged as successful.

To be honest, I kind of suspect the sender is trying to make up excuses for a problem he doesn't understand and that he found a single log of TLS failing and hoped I might buy it.  It's hard to say though, because when he enabled SSLv2 on his end (he says he did) the mails seem to be getting delivered now.  I'm just not sure what to think.

We recently had a problem with a client who could not send us email because the STARTTLS connection would always fail.  They discovered, however, that if they turned on SSLv2 (the old, insecure and no longer supported version) then things would work.  So, the question is, what version of SSL does Mercury support?

Was there an error message when the STARTTLS connection failed or did you capture the logs?   Is the session actually encrypted and are you using SSL through port 465?  The libraries used can support TLS 1.2/SSL 3.3, but there may be other reasons for the problem if you can get more detail.