There are several TLS related settings you can use in the access map:
try_tls is used when sendmail is a client (i.e. sending email)
tls_srv applies to servers, when sendmail is a client (i.e. sending email)
tls_clt applies to clients, when sendmail is a server (i.e. accepting email)
srv_features is used when sendmail is a server (i.e. accepting email), and determines features to offer
srv_features determines what features to offer (at the EHLO stage), this includes STARTTLS, and other protocol options like PIPELINING, VERBose and AUTHenticate. See §184.108.40.206 of the current Sendmail Installation and Operation Guide(PDF) for details.
tls_clt are the TLS-related settings for particular sending systems, this is used to make sure that a minimum level of encryption and/or identity (client cert) are in place by the time an email is being submitted.
tls_rcpt to configure based on recipient, it's usually used to enforce encryption, and not so useful here.)
You seem to have edited your headers, but I assume only the hostnames, and you are sending via sendmail on localhost. In this set up the client (MSP), a sendmail running as a mail submission program, uses
submit.cf and by default that has no support for any access map enabled.
The flow (excuse the ASCII art):
email → sendmail-MSP →[127.0.0.1]→ sendmail
queue runner access.db
So, you should use instead in the access map:
The "S" in
srv_features means "don't offer STARTTLS" (there are some other flags too, regarding authentication and client certs and more), then rebuild
This will only be used by the daemon sendmail server (not the submission part, or its queue runner).
You could add
FEATURE(access_db) to your
submit.mc, but that's not something to undertake lightly. See http://www.sendmail.com/sm/open_source/docs/m4/msp.html .