MTA-STS and TLS-RPT check for a domain: the _mta-sts DNS record, the published policy file (mode enforce/testing/none, allowed MX, max_age) fetched from mta-sts.<domain>, and the _smtp._tls TLS reporting record. Tells you if inbound email is protected against downgrade attacks. $0.01 per domain.