> The exim debug logs sort of look as if it is expecting to negotiate TLS > immediately on connection, rather than after the initial EHLO
Yes. Look where the 465 came from: > Transport port=465 replaced by host-specific port=587 -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/