One idea, to get more insight, you can use the following command to see which ciphers openssl would use, while you can control what it offers:
openssl s_client -starttls smtp -connect my.YOURCLOUDRON.DOMAIN:587 -cipher 'ECDHE:!aNULL' -tls1_2
So ECDHE:!aNULL can be replaced with a cipher you are certain that other server supports.
