<disclaimer>It's a small sample size but</disclaimer> every TLS connection that has arrived since I ported this to a production server (granted, on a slow Sunday afternoon) has been TLSv1.2.

I also wish our tls connection properties were named tls.cipher and tls.version (instead of tls.cipher.name and tls.cipher.version, but I don't want to break any existing use of them for the sake of making them a little tidier.

More data. Measured across 70,000 transactions (ie, connections that made it to at least the MAIL FROM phase of the connection:

• TLSv1.2 = 98.2%
• TLSv1.1 = 0.6% (just two connections, both spam, from germany and vietnam)
• TLSv1 = 0.6% (dozens of valid connections.)