How to require secure connections for E-mail?

[Strator]

I'm currently trying to configure exim to use TLS only, but it seems like things are a bit more complicated than expected (and I expected to simply add a variable to the exim configuration .

The official DA Basic system security guide links to this post which, however, is quite old:

I

Thread 'How to require secure connections for E-mail'

Apr 29, 2012

Why do we need it?
With the ubiquitous nature of mobile devices in the hands of non-technical users, they are at risk of them compromising their log in credentials at at poorly implemented or old technology hotspots. This translates into a problem for the hosting company when their credentials get into the hands of the spammers, the server gets blacklisted, and everyone else on the server are holding hosting company responsible for the service interruption. Moreover, every time such an event occurs, it requires hours of time to determine if the problem is due to a bad form on...

• IT_Architect
• Replies: 32
• Forum: How-To Guides

It recommends editing exim.conf directly, but as has been confirmed recently, that's not how we're supposed to do it.

Also, there seems to be a shorter way of getting it done, which is by setting:
hosts_require_tls = *

Problem is, it's not a variable that can be added to exim.variables.conf.custom. From what I've read, it can be added in two places:
#1 in exim.conf in the remote_smtp section (but then I'm editing exim.conf again)
#2 in exim.transports.pre.conf where several members of this forum have it. Only problem: I don't have such a file on my server, and my hunch is that adding it would open an entirely new can of worms.

Anyone with a flashlight of knowledge who can shed some light on this?