I have Dovecot running with Exim as MTA and LMTP router and transport in Exim configuration which handles saving and sending emails from and to dovecot. 

I attach the screenshots below so it perhaps can clarify my question further, I managed to send over TLS from my mail server to external emails i.e. with the outgoing emails using exim hosts_require_tls option yet I couldn't figure out how to achieve this with incoming emails(refer to received email to hi@zakaria.website screen shot in comparison to external email.)

Do you think its something to do with adding and removing headers? In which way then? Given I tried to remove and add headers of " received by " using add_header and remove_header option in exim transport, to include tls information despite when I check email headers I find them already containing mailed by over tls and LMTPS, whilst the only thing I have not tested its using :at_start: so headers to be appended at top of email file, and not sure if it would work and does LMTP at dovecot end append Received by which then overrides previous ones? and how to prevent it from doing this? as I read somewhere headers are read from bottom to top or something of such sort and last header at bottom in all incoming emails shows as was mailed by with non-tls and I cant remove it at exim point if its added by dovecot was true. Please let me know if anyone think it has something to do with Received By headers order and how to prevent dovecot from adding LMTP received by header if it does.

Note, in postfix it seems to be that there is an option setting LMTP to route and transport emails to dovecot over TLS yet I use exim and I wonder if anyone knows its equivalent?

It seems to be the issue its with the way IMAP sync emails as when checked exim log it shows email received via TLS with CV=yes, and in dovecot shows LMTP connection was made and IMAP syncing takes place normally over 993 and I use tls port 993 only given I disabled 143 yet still incoming emails shows received over unencrypted port. 

I set in dovecot 10-master, the LMTP service to use TCP and disabled unix socket and still same. I read the email its treated as local apparently at transport point from router and therefore either exim or dovecot ignores TLS and in lmtp service I fiddled with never I found anywhere suggested that is to set ssl = yes, but the LMTP connection hangs and closes and never delivers email?

In other word, how to set exim to treat all emails sent locally to accounts at my mail server and externally and received either way and, to use TLS and append needed or Received By headers accordingly?  

Btw, all received emails shows the outcome of screenshot to hi@zakaria.website.

Rewarding note, for those who read my lengthy question to last paragraph, If anyone has wondered on how to customise mailed by and signed by, I didnt find it documented anywhere therefore here its:- use Fs flag in exim begin rewrite to be set to sender@customise.domain.uk and set customise.domain.uk in DKIM sender domain as well as tls_sni option in transports. I personally advise to make sure to create sender email account and forward its emails to email which you read frequently. There might be some MUAs who would use the Fs headers address in response to sent and received emails in different circumstances and one should want to leave no email except handled.

With thanks 

Zakaria.