MTA-STS Lookup
Checks the _mta-sts DNS record, fetches the policy file over HTTPS, validates mode / max_age / mx lines and confirms every real MX host is covered. MTA-STS tells sending servers they must use a valid TLS certificate when delivering to you, which blocks downgrade and man-in-the-middle attacks on inbound mail.