App to ESA via Port 25 and ESA to destination via 587 Secure SMTP

[bedokbeacon]

Example I have an photocopy machine, web application and hmail server that sending email to gmail.com. These application are non TLS and not secure using SMTP port 25. I want to put in a ESA and when the mail sending to ESA and I want ESA to send out (relay) the email to the destination using secure SMTP via port 587

[Ken Stieers]

Other domains almost universally will NOT be supporting 587 as the generic inbound mail port.
They often support it for email clients to SEND mail... not quite the same thing.
If you want to ensure mail goes out to specific domains via TLS, for those domains, you can set a destination control under Mail Policies/Destination controls.
Set the default for TLS to be preferred, and then for specific domains you can set it to required and specify what happens if the ESA can't make that connection via TLS.