MTA-STS
A policy, published over DNS and HTTPS, that tells sending servers to deliver to your mail server over TLS only, with a valid certificate, or not at all.
Mail between servers uses TLS when both sides offer it, but the default is opportunistic: if the certificate is wrong or an attacker strips the TLS offer, delivery falls back to plaintext. MTA-STS closes that gap for mail sent to you.
It has two parts. A DNS TXT record at _mta-sts.<domain> announces that a policy exists and carries an id that you change on every update. A policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt lists your MX hosts and a mode: testing, enforce or none. A sender that supports MTA-STS fetches the file, caches it for max_age seconds, and in enforce mode refuses to deliver if TLS fails or the certificate does not match an MX in the list.
The companion record TLS-RPT (_smtp._tls.<domain>) gives senders an address for daily reports about TLS failures, which is how you learn that your policy blocks mail before your users do. DANE does the same job through DNSSEC instead of HTTPS; the two can coexist.