So, I run port 25 SMTP opportunistic encryption for incoming mail from other servers. I support all protocols because there's no reason not to. If you refuse a protocol it's just going to fall back to unencrypted.

My previous scanning vendor accepted this as a false positive when it detected that I supported TLS 1.0 and SSLv3 on port 25, but I've changed merchant account providers and the new scanning company rejected it.

I've replied to their rejection telling them that they are asking me to lower my security by doing this, so I guess we'll see what they say. Does anyone know if there's something in the PCI standards that addresses this?