You deploy a SharePoint2016 environment. You configure outgoing email settings for all SharePoint Servers. You need to enable encrypted communication between all SharePoint Servers and the…

SharePoint 2016 uses the STARTTLS upgrade mechanism, which negotiates TLS after the initial SMTP connection. The SMTP server must be configured to accept TLS 1.0, TLS 1.1, or TLS 1.2 so the encrypted handshake can complete successfully.

Outgoing email encryption in this context does not require a server certificate installed on the SharePoint Server itself; the TLS certificate requirement applies to the SMTP server that terminates the encrypted connection.

SSL 2.0 and SSL 3.0 are cryptographically broken and deprecated protocols; SharePoint 2016 STARTTLS relies on TLS, not SSL, so configuring the SMTP server for SSL 2.0/3.0 would not establish a valid encrypted channel.

In SharePoint 2016, STARTTLS behavior is governed by the outgoing email configuration and does not have a separate 'Enable STARTTLS' toggle on the SharePoint servers themselves; the required action is on the enterprise SMTP server side.

STARTTLS must be enabled on the enterprise SMTP server so it advertises the STARTTLS extension to connecting clients; without this, SharePoint has no encrypted channel to negotiate regardless of SharePoint-side settings.