DANE and TLSA records
A way to pin your mail server's certificate in DNS, signed with DNSSEC, so sending servers can verify it without trusting any certificate authority.
DANE publishes a hash of your mail server's certificate or public key in a TLSA record at _25._tcp.<mail host>. A sending server that supports DANE looks up the record, connects over TLS, and checks that the certificate it was shown matches. If it does not, delivery is refused rather than downgraded.
The record has three numbers and a hash: usage (3 means "trust this exact certificate", 2 "trust this CA"), selector (1 = public key only, 0 = whole certificate) and matching type (1 = SHA-256). 3 1 1 with the SHA-256 of the public key is the usual choice, because it survives certificate renewals that keep the same key.
DANE only means anything when the TLSA record is validated by DNSSEC; unsigned records are ignored. Sign the zone first, publish the record, and verify after every certificate change, since a stale record makes DANE-enforcing senders bounce your mail.