Free tool
DANE lets a sending server verify your mail server's certificate through DNS instead of trusting any CA, and refuses to downgrade to plaintext. It only works when the TLSA records are signed with DNSSEC. This check reads the MX hosts, the TLSA records at _25._tcp of each, and whether a validating resolver vouches for them. DNS only; no SMTP connection is made, so the certificate itself is not compared.
What this checks
A TLSA record at _25._tcp.mailhost has three numbers and a hash: usage (3 = trust this exact certificate, 2 = trust this CA, 0/1 = also require normal CA validation), selector (0 = whole certificate, 1 = public key only) and matching type (1 = SHA-256, 2 = SHA-512, 0 = full data). "3 1 1" with the SHA-256 of the public key is the common choice: it survives certificate renewals as long as the key is kept. The record is only meaningful when the whole chain from the root to it is DNSSEC-signed; without that, senders do not even look.
Related tools
Mailboxes in Luxembourg
NovaNode Mail gives you the MX, SPF, DKIM and DMARC records to copy into your DNS, with mailboxes stored in Luxembourg.
