Not just applications, servers as well. My Postfix/Dovecot setup does support unencrypted connections, but will refuse to do authentication if the channel is not encrypted.
Since it's just for backwards compatibility, modern clients should never drop to unencrypted communication. It's the server that needs to support older clients, not the other way around.
Comments
That was the whole point of STARTTLS - to allow a way to start a tunnel but be backwards compatible to older clients.
The real problem was that they didn't account for MITM attacks.
Many applications that support STARTTLS can be configured to require a secure connection to be in place before sending any data.
Not just applications, servers as well. My Postfix/Dovecot setup does support unencrypted connections, but will refuse to do authentication if the channel is not encrypted.
Which is pointless when the plaintext password has already been sent across the wire.
Since it's just for backwards compatibility, modern clients should never drop to unencrypted communication. It's the server that needs to support older clients, not the other way around.