I've changed logic which implements S2S. Now if vhost for domain is configured to require StartTLS it will also require StartTLS on S2S connection for this particular domain. Also if --hardened-mode is enable it will force usage of StartTLS on S2S connection (same as for C2S connections).

+Notice+: If StartTLS is required for S2S connection for particular domain or using hardened-mode, then we force incoming and ougoing connections to be encrypted using StartTLS.

Looks good to me.