You could try

remote x.x.x.x/y { ssl = no }

Aki

Wow. OK. But I can find no documentation on how to use that.

Would it be used inside service pop3-login, or at the top level?

And, does it apply the first match found? For example:

Disable SSL for radio clients

remote 192.168.1.0/24 { ssl = no }

Allow SSL for internal clients

remote 192.168.0.0/16 { ssl = yes }

Require SSL for all others

remote 0.0.0.0/0 { ssl = required }

Thanks, Michael