First, server-to-server delivery happens only over port 25 and no other. If the servers both want TLS, they will enable "STARTTLS" over the same port 25. They will not use the (long ago deassigned, by the way) SMTPS port 465 for anything.
Regarding intermediate hops, the message source is all you have – the Received
headers, specifically. Some mail servers do attach verbose information about the TLS connection (down to the cipher used), others just mention SMTPS, yet others say nothing at all.
It's possible that some hops will say "SMTP" because they were internal datacenter hops and the admins chose IPsec instead (or didn't care at all). It's possible that some hops didn't use SMTP at all, but HTTP (webmail) or custom internal mail shuffling protocols; the "Received" annotations vary greatly. In particular, there's often no mention at all of whether a webmail user was using HTTPS.
For example, this says ESMTPSA
– it means ESMTP (extended/EHLO SMTP) was used, over a secure (S – STARTTLS) connection.
Received: from note.local.net
by minnie.tuhs.org (Postfix) with ESMTPSA id DF028A5460;
Mon, 14 Dec 2015 21:01:29 +1000 (AEST)
(The message went through four hops total, 2 were using TLS, 2 weren't.)
Regarding the last hop (i.e. your own server), you can also check the SMTP service's log files (e.g. /var/log/exim/mainlog
or /var/log/mail.log
). If you search for the specific queue ID like DF028A5460, you'll usually find a mention some level of TLS-related information several lines above it.