- function (session, features)
- if session.conn.starttls then
- --features:tag("starttls", starttls_attr):up();
+ function (session, features)
+ -- This hook is possibly called once per host (at least if the
+ -- remote server does not specify a to/from.
+ if session.to_host and session.conn.starttls and not features:child_with_ns(xmlns_starttls) then
+ features:tag("starttls", starttls_attr):up();
+ if secure_s2s_only then
+ features:tag("required"):up():up();
+ else
+ features:up();
+ end