Many thanks, debugging with IO::Socket::SSL as suggested showed that it was a broken CA cert bundle. This also allowed me to revert to Net::SMTP as the STARTTLS redoes the EHLO, as you said, and this then properly advertised the AUTH mechanism so everything now works. It appears that certain SSL/TLS errors dont' really manifest in obvious symptoms but setting IO::Socket::SSL debugging makes the issue immediately obvious.