Security audit 2026-10-17, finding M7 (stage 6): the upstream TLS mode "Required" is Postfix's encrypt level, which verifies no certificate, so it protects against a passive observer only. Help's Upstream topic says so for both modes. check.py: 0 violations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>