Are you running lmtpd qith the -a option (preauth)? If so, then STARTTLS won't be offered, and you'll see AUTH EXTERNAL offered.
Other than that, I can't think of any reason why imapd and pop3d would offer STARTTLS and lmtpd wouldn't.
Nope, can I test if POP3 offers STARTTLS via telnet? I know the commands for IMAP/SMTP/LMTP. Here is my cyrus.conf:
lmtp cmd="lmtpd" listen="lmtp" prefork=0
This is what I get from telnet:
LHLO asd 250-imap.test.com 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-SIZE 250-AUTH LOGIN PLAIN 250 IGNOREQUOTA
Maybe the LOGIN/PLAIN is screwing it up some how? I'm converting the system (a test system) to use encrypted DB passwords, so I have to pass stuff plain text through TLS. Here is my lmtpd.conf (I patched sasl2 to use crypted mysql, it works with smtp, not sure if it's causing problems here):
mech_list: plain login log_level: 5 sql_engine: mysql sql_hostnames: 127.0.0.1 sql_user: mail sql_passwd: mail sql_database: mail sql_select: select password from users where user = '%u' sql_usessl: yes password_format: crypt srp_mda: md5 allowplaintext: yes
