What is the default behavior of any listener for TLS communication?

'Preferred-verify' is a TLS mode that both prefers encryption and validates the peer certificate; it is not the default and must be manually configured.

The Cisco ESA ships with TLS set to 'off' for all listeners by default, so the appliance does not advertise the STARTTLS SMTP extension and will accept unencrypted connections without attempting to negotiate encryption. An administrator must explicitly change the setting to 'preferred' or 'required' to enable TLS negotiation.

'Preferred' mode advertises STARTTLS and uses it when the remote host supports it but still allows unencrypted sessions; this must be explicitly enabled and is not the factory default.

'Required' mode mandates TLS and rejects any connection that cannot negotiate encryption; this is a stricter setting that must be intentionally configured.