Securing postfix to dovecot (SASL) auth

Hi

Is it possible to secure the Dovecot SASL auth provider for postfix? https://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL

I'm currently using the inet option to provide SASL auth to postfix for dovecot. Both installs are on different hosts hence the use of inet rather than unix socket.

I'm looking for the best way to secure this channel (rather than just assuming the VLAN is secure ) ,e.g. TLS. It would seem even the latest versions of dovecot/postfix3 don't support encrypting this channel?

Has anyone managed to implement a secure internal approach they can share? I'm wondering if Postfix with Cyrus against IMAP using STARTTLS is my best alternative.

Thanks Raymond