Free tool
MTA-STS tells sending servers to insist on TLS and a valid certificate when delivering to you. This check reads the DNS records that announce it and the TLS-RPT record that gets you reports. The policy file itself is not downloaded here; open it in your browser with the link shown.
What this checks
The DNS record _mta-sts.domain announces that a policy exists and carries an id that changes with every update. The policy file at https://mta-sts.domain/.well-known/mta-sts.txt lists the MX hosts and the mode. TLS-RPT (_smtp._tls.domain) gives senders an address for daily reports about failed TLS negotiations, which is how you learn that a policy is blocking mail before your users do. Start in mode testing, read the reports, then switch to enforce.
Related tools
Mailboxes in Luxembourg
NovaNode Mail gives you the MX, SPF, DKIM and DMARC records to copy into your DNS, with mailboxes stored in Luxembourg.
