Why do you need to encrypt notification emails over your own network?
If you allow the firewall to relay, or use recipients that the Postfix MTA is authoritative for, you don't need to send authentication across the wire.
Authentication credentials is only one aspect of email security. Security of the content is another.Increased security of the content is one of the reasons some people operate their own email server.
Indeed they do, and me amongst them. I am merely pointing out possible cargo cult reflexes. Just because postfix supports TLS, doesn't mean you have to implement it. The documentation warns you against it: http://www.postfix.org/TLS_README.html second paragraph.
If you require push notification by SMTP, IMHO your best bet is to design this inside the firewall and use a VPN if your MUA device travels to the public side. Horses for courses.
Postfix has three TLS options: No TLS, use if available and force TLS. Because many mail servers out there do not support TLS, it is almost impossible to force it.
If OpenSSL or LibreSSL is having such an issue, your VPN will not be any help.OpenVPN uses one of those libraries as well as StrongSwan may do. Also other services like HAProxy, the web GUI and many other services will be affected.
