The problem was this line:
builder.Port(587, true)
Is should be:
builder.Port(587, false)
Setting this to true means the endpoint is secure by default and in which case it will try to update the connection to SSL when the client connects rather than waiting for the client to issue a STARTTLS command.